Analysis
- max time kernel
76s - max time network
71s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2024, 15:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
12 signatures
150 seconds
General
- Target 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe
- Size 24KB
- Sample240620-sg8erstejb
- SHA256 16383d485ae6a1a08c59b8338789b70a6bc3ad61aa82711f3e91c2c572ad965c
- MD5 071c9001b91f0c8c60796d654be940bd
- SHA1 76cafb0fd3471984d56b584e8cda41ef05c86e35
- SHA512 cf61e2d5df9e4aa7f83e7522e8455224859fb9492ae3a94476c5e6c880477d0eef66ea65cb59bec1a454766ee93e75d7119eac933d561a1535c5c23b5292039f
- SSDEEP 384:P4fcwRMWl/e04VE1H43QxqjUyzrMDBqw7Bxnpsknfl8HFbRC8ebAbnX2RorrUOMb:CchVuH43QUjUgWBLfqRCDAbndEOMzg
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe - Loads dropped DLL 1 IoCs
pid Process 816 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{37839407-0038-4118-A501-736B90100335} 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\inpd.dll 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\inpd.dll 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe File created C:\Windows\SysWOW64\sqlkkhb.dll 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\hosts 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Custom Search URL = "1" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Search 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Use Search Asst = "no" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Search 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Use Custom Search URL = "1" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\HOMEOldSP = "about:blank" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\HOMEOldSP = "about:blank" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Bar = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst = "no" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe - Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "about:blank" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "about:blank" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe - Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13632B02-5741-4843-939F-C3CA9DFBC1D0} 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37839407-0038-4118-A501-736B90100335}\InProcServer32 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37839407-0038-4118-A501-736B90100335}\InProcServer32\ = "C:\\Windows\\SysWow64\\inpd.dll" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37839407-0038-4118-A501-736B90100335}\InProcServer32\ThreadingModel = "Apartment" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37839407-0038-4118-A501-736B90100335} 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13632B02-5741-4843-939F-C3CA9DFBC1D0}\InProcServer32 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html\CLSID = "{13632B02-5741-4843-939F-C3CA9DFBC1D0}" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13632B02-5741-4843-939F-C3CA9DFBC1D0}\InProcServer32\ = "C:\\Windows\\SysWow64\\inpd.dll" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain\CLSID = "{13632B02-5741-4843-939F-C3CA9DFBC1D0}" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13632B02-5741-4843-939F-C3CA9DFBC1D0}\InProcServer32\ThreadingModel = "Apartment" 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 816 wrote to memory of 3992 816 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe 92 PID 816 wrote to memory of 3992 816 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe 92 PID 816 wrote to memory of 3992 816 071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\aojg.bat "C:\Users\Admin\AppData\Local\Temp\071c9001b91f0c8c60796d654be940bd_JaffaCakes118.exe"2⤵PID:3992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\aojg.bat
- Size 70B
- SHA256 2d8efe1526fa203539bc77da8570b4cb38d5a63836a76d2379b7b506d0a67ee0
- MD5 677931564938373367422e56cdf23934
- SHA1 fb077020992d9fa49a901d3b64c3d9ce5bb88b35
- SHA512 808e177716911a5b975449b55df4fe1fc97cdb929be621fe541a7dfe7dce3362039214fe1ab4760c4d67aafe8a12308d04e5a40dc028b848c154f3e3f2d120ba
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\inpd.dll
- Size 30KB
- SHA256 7b124726efa67291ed628c9a2685df56eb9e8068d4426281dddb9b0670b1df1f
- MD5 758c70a518598b15ded281781fde445f
- SHA1 608b09dce16028ae01522f0621c0f48a87f84d50
- SHA512 691b2dc804502d05fa5c2fc8f44346a4d0cc433f674d8e1006b45dd77453c0d835e0ffe33b973d4d673ede0f6f45e03c2bbc436038acce1cc388f12d5ac9830b
- SSDEEP 768:2qx2EcqU0jMZ0V2/koscpujLrNYsBj+2qY7q:2zEcb0jA0V2YjnNYAq2
- MD5 SHA1 SHA512 SSDEEP