Analysis
- max time kernel
147s - max time network
122s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
17/06/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
b6ad8588229982888954072f71a99de1_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b6ad8588229982888954072f71a99de1_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target b6ad8588229982888954072f71a99de1_JaffaCakes118.exe
- Size 1.6MB
- Sample240617-epwt2stcmc
- SHA256 99762ccb393794537a2cee5a8b149ed419a01236e8c688ae23ab52ccc9c284c2
- MD5 b6ad8588229982888954072f71a99de1
- SHA1 d57a44a356e58f1798b65f6f278ff0cc38994d55
- SHA512 5c896ab394a837ca0689080858b983ad52706f1e216b2a0ae098d5a63188b5665abc4af43161669e438091fd5153b11203eb8e051d4e1aa3431d3ae62b9a3c5b
- SSDEEP 49152:tvxQFwhHCDzeYvlDRVSMWZPIFEkxJCI8k:Aih6vlDRVSMokb
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 b6ad8588229982888954072f71a99de1_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "0" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "0" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "1" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "1" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING \b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "1" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "0" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "11000" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "0" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "0" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI \b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "0" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "1" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "0" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "1" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "1" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\b6ad8588229982888954072f71a99de1_JaffaCakes118.exe = "1" b6ad8588229982888954072f71a99de1_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM b6ad8588229982888954072f71a99de1_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2336 b6ad8588229982888954072f71a99de1_JaffaCakes118.exe 2336 b6ad8588229982888954072f71a99de1_JaffaCakes118.exe 2336 b6ad8588229982888954072f71a99de1_JaffaCakes118.exe 2336 b6ad8588229982888954072f71a99de1_JaffaCakes118.exe