Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 23:10
Static task
static1
Behavioral task
behavioral1
Sample
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe
-
Size
9.3MB
-
MD5
abed41b3b60eb1d9348e9bf66da294df
-
SHA1
8574851b18d4133fd06c477e20f5aa2ed9767dcb
-
SHA256
c0ac94a4b322299f8c66705b3960d00861ee8d6463c456078674b5212fbca6e0
-
SHA512
b4c98c1053edf58a563501d5ad207eab2ec8737014711c1fa012597ccc5f41b92c6dbc5854e902f4512234c1445b567e67a4aee896c67b0804b463f907a6c812
-
SSDEEP
196608:NRH5KNqlUgN7AktVweDO+oPG5eWWi/zio/i:02O+o+wWrX/
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exedescription ioc process File opened (read-only) \??\V: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\Y: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\H: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\M: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\N: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\R: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\S: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\U: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\X: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\F: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\E: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\G: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\I: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\T: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\W: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\K: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\O: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\P: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\J: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\L: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\Q: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe File opened (read-only) \??\Z: abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TenioDL.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation TenioDL.exe -
Executes dropped EXE 1 IoCs
Processes:
TenioDL.exepid process 1388 TenioDL.exe -
Loads dropped DLL 6 IoCs
Processes:
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exeTenioDL.exepid process 3576 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe 1388 TenioDL.exe 3576 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe 3576 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe 1388 TenioDL.exe 1388 TenioDL.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
Processes:
TenioDL.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid TenioDL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\metnsd TenioDL.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid\SequenceID = d8eb4477d054554daf930a4ba2e6a658 TenioDL.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exepid process 3576 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe 3576 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
TenioDL.exedescription pid process Token: SeManageVolumePrivilege 1388 TenioDL.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exeTenioDL.exedescription pid process target process PID 3576 wrote to memory of 1388 3576 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe TenioDL.exe PID 3576 wrote to memory of 1388 3576 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe TenioDL.exe PID 3576 wrote to memory of 1388 3576 abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe TenioDL.exe PID 1388 wrote to memory of 5092 1388 TenioDL.exe icacls.exe PID 1388 wrote to memory of 5092 1388 TenioDL.exe icacls.exe PID 1388 wrote to memory of 5092 1388 TenioDL.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\abed41b3b60eb1d9348e9bf66da294df_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exeC:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" C:\Users\Admin\AppData\Roaming\Tencent\Config\ /t /setintegritylevel low3⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.dllFilesize
523KB
MD534431eb1ae2d3ac86e3415d8c3e977a3
SHA1b2eae82dffecdbe02ef877d5a4d28de83b84bd59
SHA2568379e09c7a3a51bdb652418781ceed8067e324b656c7d5a307b9a77c899f0806
SHA51232b1d12630ced494b5168037a1d0899b3576970f603b5e69bf48fd915a4dad51d877e97bc91660929719e3a1395344ec39d5cc5b761111096c4523563d3bdd5e
-
C:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL.exeFilesize
167KB
MD58fb4e336f4c145eb6e379701c3ac59d1
SHA1ad53b732cabd515035784f187aeaab4d8a6b67c7
SHA256d7a59b5ba3f0fb3906ebaa7a67c76088995a1f37652a2ae9893977c19754d9bf
SHA512c83b726e867f47c9fdabaf3151ae74c07e2b74be47f8ec41685fee744eba41c81614faaf473fcd28cabc044545eddcad5cbbaf67e90109d916e109c1b5d6a770
-
C:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\TenioDL_core.dllFilesize
543KB
MD511d65a68132e918bd80e7e0a09029730
SHA1c1978c02176e1e370c66d1597e964eab908847dc
SHA25636c18dedac0429375c583fcf9420cdc9ace8a38bbac9f33378b5b4d6739da511
SHA51234278a85cfdad1b2086b9368368b6eada08829c3237d02d0afbfced4f32df38e95a5ca0a600fc8d8c98c33d6cc8d4ac82c3279ccdba36cb0ed4738c1c0648315
-
C:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\dr.dllFilesize
74KB
MD52814acbd607ba47bdbcdf6ac3076ee95
SHA150ab892071bed2bb2365ca1d4bf5594e71c6b13b
SHA2565904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67
SHA51234c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498
-
C:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\p2papp.dllFilesize
2.9MB
MD5b1b101d86c417286e60f471fc8b79bb1
SHA1b602bee2a25ed63a1f9cda72c83bdadd44dcd07c
SHA25691cfa1769be449dfdfbf6bcc8049ce5c9218df6deaa66a0879528526b204a51a
SHA5120a1d03364e1a52c08d6992a52b31b29f54c3781c009562427c560338db5428b74b55fab41f9c48c7018ddce41ab6a7f8593fbf12a75ae472c11590a36b42682b
-
C:\test.tmpFilesize
4B
MD549096510e26480fac1840f024230c101
SHA11c744e5bf038e2da4d7757a1af7ad5de7d714610
SHA256e59f4a3c577c5f68bb26cb1931bebb4767d2017d3862b5a5cae271eb0b9c0a8d
SHA5121cd8e019509f19f5c291d242958f1be9f322b4831ab90df2cb70257bebff6a9000b7046fac16f0932bc6b04cdce2e773fc17c67c75ef20c0c17929d76c221847
-
memory/1388-35-0x0000000002550000-0x000000000283F000-memory.dmpFilesize
2.9MB
-
memory/3576-27-0x00000000034A0000-0x00000000034B1000-memory.dmpFilesize
68KB