Analysis
- max time kernel
142s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe
- Size 782KB
- Sample240603-jpfv2sge2v
- SHA256 220da47aa2b28f1ac57775638f287d4742afe1b0c05f83370dac921c35ba3580
- MD5 9102c1f44f1730b0622507b3057fab12
- SHA1 4406aa5a2f80cd10d33fc5e8e0e6aa318247416f
- SHA512 3b95e408a3a691612ff9bd5717011f6d9decf507241490e7a5f32af64e2a304e59cab83c304aec224a190a230e45822aa66956e65d419105da6c52a7a81a2525
- SSDEEP 24576:OLa9FmxsOhIY/8bamGs9KJ/sJmkWtJcug3J6l40Xun6nCS:OLafmoemG0KJ/QaTSJu40XZD
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\S: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\U: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\G: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\I: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\J: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\Q: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\W: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\X: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\K: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\N: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\O: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\V: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\Y: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\H: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\M: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\T: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\Z: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\E: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\L: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe File opened (read-only) \??\P: 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e00310000000000c358513e100054656d7000003a0009000400efbe5a589971c358513e2e000000bce10100000001000000000000000000000000000000a4c51a01540065006d007000000014000000 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000005a584d7e10004c6f63616c003c0009000400efbe5a589971c358533e2e000000bbe101000000010000000000000000000000000000004ee102014c006f00630061006c00000014000000 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c004346534616003100000000005a589971120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe5a589971c358533e2e000000a8e101000000010000000000000000000000000000001a54ab004100700070004400610074006100000042000000 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2432 9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9102c1f44f1730b0622507b3057fab12_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2432
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵PID:3308