Analysis
-
max time kernel
66s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:22
Behavioral task
behavioral1
Sample
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe
-
Size
666KB
-
MD5
03c19f682f1d136506cb4d57ccae4016
-
SHA1
1c0ee1ec6682884ddb5295b5edb141d4ff1a7b26
-
SHA256
b1fea92292d31a42ed32e07adafa3659948b7401e7cffade033e5316a46bd9ec
-
SHA512
8c1ca59da6d5cae5db16c0fc258d4e0bcddc2e369deb2efc1227c6dbfdbdeea45ad5b7c950603f0928b86b26aebbdbde5f972848ce21f0364ab94d387bab6d77
-
SSDEEP
12288:qbDqEkMs4q48IAeP0PifTEurPbvdqJplapLWTICNIYPKMTWN4t4OAUw91zRwIMfe:qXbs48LeP0P8E6dclWLi26KGOqMwIMG
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/1048-0-0x0000000000400000-0x00000000005C7000-memory.dmp upx behavioral2/memory/1048-1-0x0000000000400000-0x00000000005C7000-memory.dmp upx behavioral2/memory/1048-3-0x0000000000400000-0x00000000005C7000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1644 1048 WerFault.exe 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 4340 1048 WerFault.exe 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exepid process 1048 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 1048 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 1048 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 1048 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 1048 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 1048 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 1048 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 1048 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 1048 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 21402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 21802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1048 -ip 10481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1048 -ip 10481⤵