Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 01:10
Static task
static1
Behavioral task
behavioral1
Sample
fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe
-
Size
137KB
-
MD5
fe13c06ef08634e69555b8c1d009bcb9
-
SHA1
61211386481811b31cc2f899b2134a0ce638a264
-
SHA256
28ce4f3e1448c91520eeb42861a2fdbe473adc1c48dfffe22a48f54406a97948
-
SHA512
a64f6b5595c980d9d2f37475afdc1e911bfb8ca16f8f0895a9209772832416afffc4f59d3a072b318e55324809459fd76e677cfadd1539a31bcfeb31a30ebf1d
-
SSDEEP
3072:/wpMn7cYBxzHlSXQ3NhueuQYeLJ3Jh9ypXxXfUfCwhko:/EAcjQY6pJipa
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
x0xBIn7Udescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation x0xBIn7U -
Executes dropped EXE 2 IoCs
Processes:
x0xBIn7Ugovpvjhbykcddjnr.exepid process 2472 x0xBIn7U 4796 govpvjhbykcddjnr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4560 4596 WerFault.exe svchost.exe 4492 3528 WerFault.exe svchost.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4211013870" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101832" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4205232674" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101832" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101832" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101833" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420426893" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{263D375B-FF7C-11EE-95FD-F6FECC981AF9} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4211013870" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4205232674" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101832" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "116359557" IEXPLORE.EXE -
Modifies registry class 1 IoCs
Processes:
fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 660 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
x0xBIn7Ugovpvjhbykcddjnr.exedescription pid process Token: SeSecurityPrivilege 2472 x0xBIn7U Token: SeDebugPrivilege 2472 x0xBIn7U Token: SeSecurityPrivilege 4796 govpvjhbykcddjnr.exe Token: SeLoadDriverPrivilege 4796 govpvjhbykcddjnr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
IEXPLORE.EXEpid process 5076 IEXPLORE.EXE 5076 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exeOpenWith.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 864 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe 4440 OpenWith.exe 5076 IEXPLORE.EXE 5076 IEXPLORE.EXE 548 IEXPLORE.EXE 548 IEXPLORE.EXE 5076 IEXPLORE.EXE 5076 IEXPLORE.EXE 3540 IEXPLORE.EXE 3540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exex0xBIn7Uiexplore.exeIEXPLORE.EXEiexplore.exedescription pid process target process PID 864 wrote to memory of 2472 864 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe x0xBIn7U PID 864 wrote to memory of 2472 864 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe x0xBIn7U PID 864 wrote to memory of 2472 864 fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe x0xBIn7U PID 2472 wrote to memory of 4596 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 4596 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 4596 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 4596 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 4596 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 4596 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 4596 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 4596 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 4596 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 3032 2472 x0xBIn7U iexplore.exe PID 2472 wrote to memory of 3032 2472 x0xBIn7U iexplore.exe PID 2472 wrote to memory of 3032 2472 x0xBIn7U iexplore.exe PID 3032 wrote to memory of 5076 3032 iexplore.exe IEXPLORE.EXE PID 3032 wrote to memory of 5076 3032 iexplore.exe IEXPLORE.EXE PID 5076 wrote to memory of 548 5076 IEXPLORE.EXE IEXPLORE.EXE PID 5076 wrote to memory of 548 5076 IEXPLORE.EXE IEXPLORE.EXE PID 5076 wrote to memory of 548 5076 IEXPLORE.EXE IEXPLORE.EXE PID 2472 wrote to memory of 3528 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 3528 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 3528 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 3528 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 3528 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 3528 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 3528 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 3528 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 3528 2472 x0xBIn7U svchost.exe PID 2472 wrote to memory of 1328 2472 x0xBIn7U iexplore.exe PID 2472 wrote to memory of 1328 2472 x0xBIn7U iexplore.exe PID 2472 wrote to memory of 1328 2472 x0xBIn7U iexplore.exe PID 1328 wrote to memory of 4192 1328 iexplore.exe IEXPLORE.EXE PID 1328 wrote to memory of 4192 1328 iexplore.exe IEXPLORE.EXE PID 5076 wrote to memory of 3540 5076 IEXPLORE.EXE IEXPLORE.EXE PID 5076 wrote to memory of 3540 5076 IEXPLORE.EXE IEXPLORE.EXE PID 5076 wrote to memory of 3540 5076 IEXPLORE.EXE IEXPLORE.EXE PID 2472 wrote to memory of 4796 2472 x0xBIn7U govpvjhbykcddjnr.exe PID 2472 wrote to memory of 4796 2472 x0xBIn7U govpvjhbykcddjnr.exe PID 2472 wrote to memory of 4796 2472 x0xBIn7U govpvjhbykcddjnr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe13c06ef08634e69555b8c1d009bcb9_JaffaCakes118.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x0xBIn7U"x0xBIn7U"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 924⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5076 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5076 CREDAT:17414 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 2084⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\govpvjhbykcddjnr.exe"C:\Users\Admin\AppData\Local\Temp\govpvjhbykcddjnr.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4596 -ip 45961⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3528 -ip 35281⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verFCA0.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ITM01P8V\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\x0xBIn7UFilesize
95KB
MD59e9ad7686371d18a65e9193b5279ae3a
SHA132387208357480c8e5d519a6cd64117a50303953
SHA256a184487f8f4edf4ff4c90dce3f1fbd45031a528046eadbac44287e405e74c4bf
SHA5123a6d2548f47ad4b95035908b483afcf87969ecab27598aff423f0a77e8c6851bf35a6956ba24fe56b57cfe3e3cfbe257c1f70a7f349e6b3b9f53547a31cb42e5
-
memory/864-15-0x0000000001000000-0x0000000001025000-memory.dmpFilesize
148KB
-
memory/864-0-0x0000000001000000-0x0000000001025000-memory.dmpFilesize
148KB
-
memory/2472-8-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/2472-9-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/2472-11-0x00000000004A0000-0x00000000004A2000-memory.dmpFilesize
8KB
-
memory/2472-7-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/2472-10-0x0000000077C72000-0x0000000077C73000-memory.dmpFilesize
4KB
-
memory/2472-5-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/2472-16-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/2472-20-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/2472-22-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/2472-23-0x0000000077C72000-0x0000000077C73000-memory.dmpFilesize
4KB
-
memory/4596-13-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/4596-14-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4796-44-0x0000000000490000-0x0000000000492000-memory.dmpFilesize
8KB
-
memory/4796-43-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB
-
memory/4796-38-0x0000000000400000-0x0000000000439CC8-memory.dmpFilesize
231KB