Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 20:54
Static task
static1
Behavioral task
behavioral1
Sample
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe
-
Size
4.4MB
-
MD5
a251ab42e6336d564b858cdeefc2678b
-
SHA1
660beae5f5312471029cc1393f1477408cbf6697
-
SHA256
fd12ad7d9ac7ea5d0719ee1e9c1693e8aa55777ab695e87e1286474bad5b476b
-
SHA512
ce9f82087e3e0625afc44e586f53c4363208c871314c93978699f256bcd835b492d3ff19cc7fbfe43c9f7b2533cfb123d1769e9090bb9c3068f3e5addaf13094
-
SSDEEP
98304:tNwEf0x018aUP9GndDTFLx4FejNMaDje4Cq67QfguIPPt9oEW:tNwE8wUEn9T9mejXFM7QYZtlW
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exepid process 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
Processes:
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exepid process 836 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe 836 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe upx behavioral1/memory/2792-12-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/2792-22-0x0000000000400000-0x0000000000462000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exepid process 836 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA51A981-28FD-11EF-8D12-66A5A0AB388F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424387540" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA518271-28FD-11EF-8D12-66A5A0AB388F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exea251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exepid process 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe 836 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exedescription pid process Token: SeDebugPrivilege 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 2356 iexplore.exe 2372 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 2356 iexplore.exe 2356 iexplore.exe 2372 iexplore.exe 2372 iexplore.exe 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exea251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exeiexplore.exeiexplore.exedescription pid process target process PID 836 wrote to memory of 2792 836 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe PID 836 wrote to memory of 2792 836 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe PID 836 wrote to memory of 2792 836 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe PID 836 wrote to memory of 2792 836 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe PID 2792 wrote to memory of 2372 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe iexplore.exe PID 2792 wrote to memory of 2372 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe iexplore.exe PID 2792 wrote to memory of 2372 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe iexplore.exe PID 2792 wrote to memory of 2372 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe iexplore.exe PID 2792 wrote to memory of 2356 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe iexplore.exe PID 2792 wrote to memory of 2356 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe iexplore.exe PID 2792 wrote to memory of 2356 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe iexplore.exe PID 2792 wrote to memory of 2356 2792 a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe iexplore.exe PID 2356 wrote to memory of 2772 2356 iexplore.exe IEXPLORE.EXE PID 2356 wrote to memory of 2772 2356 iexplore.exe IEXPLORE.EXE PID 2356 wrote to memory of 2772 2356 iexplore.exe IEXPLORE.EXE PID 2356 wrote to memory of 2772 2356 iexplore.exe IEXPLORE.EXE PID 2372 wrote to memory of 2904 2372 iexplore.exe IEXPLORE.EXE PID 2372 wrote to memory of 2904 2372 iexplore.exe IEXPLORE.EXE PID 2372 wrote to memory of 2904 2372 iexplore.exe IEXPLORE.EXE PID 2372 wrote to memory of 2904 2372 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EA518271-28FD-11EF-8D12-66A5A0AB388F}.datFilesize
3KB
MD5323e0f4aa557e1ed7749fb9b74c19306
SHA11d069b9efad8cd0dd5361686a91864b63be7e5d4
SHA256ce549943395689af5ad7c0aab562f3aeb03c1f4a84ca6319604a8b232c0054f4
SHA512c78d3bd1feacac931e17b496aaa58df6afed386ced52253e39933c985425e983ff731cd529fa2c0d20e71c509cbc42916a6a109fed54d31b6ff77f19d1689fbd
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EA51A981-28FD-11EF-8D12-66A5A0AB388F}.datFilesize
3KB
MD5364735d5ef7837292e4fe03255c53759
SHA131f2557d8fd5053513b9b4483bcccb129cad06f0
SHA256a06e5ecea1362421876444d82fc9506c8a1c7f19f937ca65ff08f2944c252081
SHA5120c7d7f27c9e0d119fe885ef8c326ad6a2c13c91196a5e39064fc7c4914df6d2a0eab9e726ab96f317bc1187a8483fbda4a5f0106734f55e1ac09c6892bed72f4
-
\Users\Admin\AppData\Local\Temp\a251ab42e6336d564b858cdeefc2678b_JaffaCakes118mgr.exeFilesize
106KB
MD57dc51d67dba12402674baf7e67bfc89d
SHA194b2e12ec5f4258bf8727d53276331457a558edb
SHA256ebaf815f84fd4fb931265e7c92119d2ad540620dfe9f8883a4f08b6796318f87
SHA5125d76770e6fab626f6b7de2126ef8af39bb2e49162dc0c14d06a074653a68ecb6bc381d930ce974ebc2f8c4dfcfa7502f8699a426cd837230d497165ddbf6c901
-
memory/836-10-0x0000000000400000-0x0000000000E9A000-memory.dmpFilesize
10.6MB
-
memory/836-14-0x0000000000220000-0x0000000000282000-memory.dmpFilesize
392KB
-
memory/836-11-0x0000000000220000-0x0000000000282000-memory.dmpFilesize
392KB
-
memory/836-15-0x0000000000400000-0x0000000000E9A000-memory.dmpFilesize
10.6MB
-
memory/836-26-0x0000000000400000-0x0000000000E9A000-memory.dmpFilesize
10.6MB
-
memory/2792-13-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2792-12-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/2792-9-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2792-8-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2792-22-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB