Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 23:10
Static task
static1
Behavioral task
behavioral1
Sample
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe
-
Size
9.3MB
-
MD5
abed41b3b60eb1d9348e9bf66da294df
-
SHA1
8574851b18d4133fd06c477e20f5aa2ed9767dcb
-
SHA256
c0ac94a4b322299f8c66705b3960d00861ee8d6463c456078674b5212fbca6e0
-
SHA512
b4c98c1053edf58a563501d5ad207eab2ec8737014711c1fa012597ccc5f41b92c6dbc5854e902f4512234c1445b567e67a4aee896c67b0804b463f907a6c812
-
SSDEEP
196608:NRH5KNqlUgN7AktVweDO+oPG5eWWi/zio/i:02O+o+wWrX/
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exedescription ioc process File opened (read-only) \??\G: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\H: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\L: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\N: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\O: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\P: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\S: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\E: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\Y: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\Z: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\W: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\M: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\V: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\X: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\I: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\R: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\T: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\F: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\K: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\Q: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\U: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\J: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
TenioDL.exepid process 2616 TenioDL.exe -
Loads dropped DLL 8 IoCs
Processes:
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exeTenioDL.exepid process 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe 2616 TenioDL.exe 2616 TenioDL.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
Processes:
TenioDL.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid TenioDL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\metnsd TenioDL.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid\SequenceID = 5c3700261c1fed42bde462a9e64e4bf3 TenioDL.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exepid process 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
TenioDL.exedescription pid process Token: SeManageVolumePrivilege 2616 TenioDL.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exeTenioDL.exedescription pid process target process PID 1600 wrote to memory of 2616 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe TenioDL.exe PID 1600 wrote to memory of 2616 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe TenioDL.exe PID 1600 wrote to memory of 2616 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe TenioDL.exe PID 1600 wrote to memory of 2616 1600 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe TenioDL.exe PID 2616 wrote to memory of 2204 2616 TenioDL.exe icacls.exe PID 2616 wrote to memory of 2204 2616 TenioDL.exe icacls.exe PID 2616 wrote to memory of 2204 2616 TenioDL.exe icacls.exe PID 2616 wrote to memory of 2204 2616 TenioDL.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exeC:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" C:\Users\Admin\AppData\Roaming\Tencent\Config\ /t /setintegritylevel low3⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL_core.dllFilesize
543KB
MD511d65a68132e918bd80e7e0a09029730
SHA1c1978c02176e1e370c66d1597e964eab908847dc
SHA25636c18dedac0429375c583fcf9420cdc9ace8a38bbac9f33378b5b4d6739da511
SHA51234278a85cfdad1b2086b9368368b6eada08829c3237d02d0afbfced4f32df38e95a5ca0a600fc8d8c98c33d6cc8d4ac82c3279ccdba36cb0ed4738c1c0648315
-
C:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\p2papp.dllFilesize
2.9MB
MD5b1b101d86c417286e60f471fc8b79bb1
SHA1b602bee2a25ed63a1f9cda72c83bdadd44dcd07c
SHA25691cfa1769be449dfdfbf6bcc8049ce5c9218df6deaa66a0879528526b204a51a
SHA5120a1d03364e1a52c08d6992a52b31b29f54c3781c009562427c560338db5428b74b55fab41f9c48c7018ddce41ab6a7f8593fbf12a75ae472c11590a36b42682b
-
\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.dllFilesize
523KB
MD534431eb1ae2d3ac86e3415d8c3e977a3
SHA1b2eae82dffecdbe02ef877d5a4d28de83b84bd59
SHA2568379e09c7a3a51bdb652418781ceed8067e324b656c7d5a307b9a77c899f0806
SHA51232b1d12630ced494b5168037a1d0899b3576970f603b5e69bf48fd915a4dad51d877e97bc91660929719e3a1395344ec39d5cc5b761111096c4523563d3bdd5e
-
\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exeFilesize
167KB
MD58fb4e336f4c145eb6e379701c3ac59d1
SHA1ad53b732cabd515035784f187aeaab4d8a6b67c7
SHA256d7a59b5ba3f0fb3906ebaa7a67c76088995a1f37652a2ae9893977c19754d9bf
SHA512c83b726e867f47c9fdabaf3151ae74c07e2b74be47f8ec41685fee744eba41c81614faaf473fcd28cabc044545eddcad5cbbaf67e90109d916e109c1b5d6a770
-
\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\dr.dllFilesize
74KB
MD52814acbd607ba47bdbcdf6ac3076ee95
SHA150ab892071bed2bb2365ca1d4bf5594e71c6b13b
SHA2565904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67
SHA51234c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498
-
memory/1600-23-0x0000000000510000-0x0000000000521000-memory.dmpFilesize
68KB
-
memory/1600-27-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/2616-32-0x00000000022B0000-0x000000000259F000-memory.dmpFilesize
2.9MB