Analysis
-
max time kernel
141s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 04:54
Behavioral task
behavioral1
Sample
0ca4044e94b8487e7feb4fe8039c2f26_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0ca4044e94b8487e7feb4fe8039c2f26_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0ca4044e94b8487e7feb4fe8039c2f26_JaffaCakes118.exe
-
Size
123KB
-
MD5
0ca4044e94b8487e7feb4fe8039c2f26
-
SHA1
a00b6d3c4660d2b3c97e7f7bb8b50f23272e10ec
-
SHA256
bddd5e0f69e0207c7a9deb750ab0c1097e61f4da4beed1aa569156c7bd021ad7
-
SHA512
8fd6a037746a7f355589f6d9cabffa7cd9e19da0978901bee3c954e85eae65cf7e75562eed3511dc66ddd39c2c611ac813f0227877e54c2ae1e01cc8d472f70e
-
SSDEEP
3072:NeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLseHGxOdfkA:NVYrJrOSsRwcptHGusA
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\62119EF862C6B3A0D853419B87EB3E2F6C78640A\Blob = 03000000010000001400000062119ef862c6b3a0d853419b87eb3e2f6c78640a2000000001000000df030000308203db30820344a00302010202033fc398300d06092a864886f70d01010405003055310b3009060355040613025a4131253023060355040a131c54686177746520436f6e73756c74696e67202850747929204c74642e311f301d0603550403131654686177746520436f6465205369676e696e67204341301e170d3035303831353031353134345a170d3037303931363133323531325a30818b310b3009060355040613024652310e300c0603550408130552686f6e65310d300b060355040713044c796f6e31193017060355040a1310656c656374726f6e69632d67726f757031273025060355040b131e536563757265204170706c69636174696f6e20446576656c6f706d656e743119301706035504031310656c656374726f6e69632d67726f757030820122300d06092a864886f70d01010105000382010f003082010a0282010100e2754d8a4e6d4db6e025b0073520ddd7eeec116a813940fda2c4c66f7a354adb3036188d4078f8891b3fe15d467dfba5e17984cac2b246c27c052e63956dfe817eb423b9615bddfddaadac5e2ac0f41f583edd24d7830f5875df2937a9152b741eef3950e5116e76d2e7e3ffdf6fcb5858af26f5e2effd019a1f82b98d7f21ed089d5bb8553cd89c823becaeb62ea1cc4b455cb4e93e8ac715320f31dc3fbc2d0be0d65c608c58c19ff06da7bc1ec48a45ef0219eef40294504e2663b1c9dad6a2241df996c59cf110b706285fbaeae0c55d776573536218c3c7ae248b82cae01513cd8b2828a94f4a70ba6e199919a0f5eae20643feaabebe2ba3b2819e92790203010001a381fd3081fa301f0603551d250418301606082b06010505070303060a2b060104018237020116301106096086480186f8420101040403020410301d0603551d0404163014300e300c060a2b0601040182370201160302078030230603551d11041c301a82187777772e656c656374726f6e69632d67726f75702e636f6d303e0603551d1f043730353033a031a02f862d687474703a2f2f63726c2e7468617774652e636f6d2f546861777465436f64655369676e696e6743412e63726c303206082b0601050507010104263024302206082b060105050730018616687474703a2f2f6f6373702e7468617774652e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010405000381810075160a692f4bc2096bce67c58b0d88320552104e4d35f5018bc2ab1be03ecae3c0abe7db45629b1b3c1812039145c15d6f2774c211a2c86f93a819573d58a3c0e66d1e19e84638800e3372880b4e9cdcf70cc769bdeff236ed3ac6f20e370122fa791e71b0ea8be78077ffc288c382b201d78ea8bbf9e9457fad4ee80273279c regedit.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023400-27.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation iaccess32.exe -
Executes dropped EXE 1 IoCs
pid Process 4180 iaccess32.exe -
Loads dropped DLL 1 IoCs
pid Process 2128 regsvr32.exe -
resource yara_rule behavioral2/memory/4532-0-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/files/0x000700000002328e-3.dat upx behavioral2/memory/4532-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4180-7-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/files/0x0007000000023400-27.dat upx behavioral2/memory/2128-29-0x0000000010000000-0x0000000010047000-memory.dmp upx behavioral2/memory/4180-55-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4180-61-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\egaccess4_1071.dll iaccess32.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files (x86)\Instant Access\Multi\20110130130107\instant access.exe iaccess32.exe File created C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk iaccess32.exe File created C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110130130107\medias\p2e.ico iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110130130107\dialerexe.ini iaccess32.exe File opened for modification C:\Program Files (x86)\Instant Access\Multi\20110130130107\dialerexe.ini iaccess32.exe File opened for modification C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110130130107\medias\p2e_logo_2.gif iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110130130107\medias\p2e_go_3.gif iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110130130107\medias\p2e_3_3.gif iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110130130107\medias\p2e_2_3.gif iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110130130107\Common\module.php iaccess32.exe File created C:\Program Files (x86)\Instant Access\Multi\20110130130107\medias\p2e_1_3.gif iaccess32.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\iaccess32.exe 0ca4044e94b8487e7feb4fe8039c2f26_JaffaCakes118.exe File created C:\Windows\tmlpcert2007 iaccess32.exe File created C:\Windows\dialexe.zl iaccess32.exe File created C:\Windows\dialexe.epk iaccess32.exe File created C:\Windows\dialerexe.ini iaccess32.exe File created C:\Windows\egdhtm_pack.epk iaccess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\À iaccess32.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ = "C:\\Windows\\SysWow64\\egaccess4_1071.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83} regsvr32.exe -
Runs regedit.exe 1 IoCs
pid Process 2972 regedit.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4532 0ca4044e94b8487e7feb4fe8039c2f26_JaffaCakes118.exe 4180 iaccess32.exe 4180 iaccess32.exe 4180 iaccess32.exe 4180 iaccess32.exe 4180 iaccess32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4532 wrote to memory of 4180 4532 0ca4044e94b8487e7feb4fe8039c2f26_JaffaCakes118.exe 80 PID 4532 wrote to memory of 4180 4532 0ca4044e94b8487e7feb4fe8039c2f26_JaffaCakes118.exe 80 PID 4532 wrote to memory of 4180 4532 0ca4044e94b8487e7feb4fe8039c2f26_JaffaCakes118.exe 80 PID 4180 wrote to memory of 2972 4180 iaccess32.exe 81 PID 4180 wrote to memory of 2972 4180 iaccess32.exe 81 PID 4180 wrote to memory of 2972 4180 iaccess32.exe 81 PID 4180 wrote to memory of 2128 4180 iaccess32.exe 82 PID 4180 wrote to memory of 2128 4180 iaccess32.exe 82 PID 4180 wrote to memory of 2128 4180 iaccess32.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ca4044e94b8487e7feb4fe8039c2f26_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0ca4044e94b8487e7feb4fe8039c2f26_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\iaccess32.exeC:\Windows\iaccess32.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert20073⤵
- Manipulates Digital Signatures
- Runs regedit.exe
PID:2972
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"3⤵
- Loads dropped DLL
- Modifies registry class
PID:2128
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5386dc0f145c76b93f7cf859985755ea3
SHA18867dc0c01e05da744d34cc889b9cb2bb5a50941
SHA256cefdd4dc451980d58300fab7c647fe0848b9cfabd80339d954957a0d00514437
SHA51236fb1abde9d0831e0fdf0d21797f627343f03c98dcf7f82948d6393c839905430e0f2acdb238fb2d9c3df3216c80732601d63a5cb0bcbe51e460379bd696df6b
-
Filesize
668B
MD55aee5536dd1dcdc8f35af1aff5e66149
SHA1d97de3e5b2bf32ace92dd729f2c8c48783adf88d
SHA256ba81f92fa7c56b01a478ac9b0feecd451b7ef85cf4fac8a68d5d32f3ab5b0344
SHA5129b455f61922b25107c16211f01e57a822898b63e8d9674664654acd340905793dd37822034e403d7963e17ab430bbd1aec664c756fdaa189cf028202735635eb
-
Filesize
76KB
MD5b83f652ffa76451ae438954f89c02f62
SHA1b3ba0014dd16cee5f6d4cfe7e28b2d5de79dc6dd
SHA256f601991aa00cbe7001197affc0e3854ab76c51c05b9a6ca3e3f708fed876c32f
SHA512965172a5ecd070ea6707ec9985ee3c135c06534561b90ae233e8049b247d87d529b8280f0faf2b0ed933f59c68844414726fa80c4d3119cffa4fdd1cb60eab83
-
Filesize
123KB
MD5c02cfde3c1f1f7c3dc69f87112cea963
SHA14545e2d595c91e9f8bb6b62c33658158fc897d03
SHA256b71db4181ca19ae8ba81f007465a824e0660e95d4a9957c8aed513881cac3aa6
SHA512f0a8695d4e3389188985c78ef3e779cc153d129b41afb1d85d1d0385d1975ff442e46e013ec0ce91cd39ba0c28d8cdb1d9b6fcf2409178e13e2efa8e9b291b2b
-
Filesize
6KB
MD5b103757bc3c714123b5efa26ff96a915
SHA1991d6694c71736b59b9486339be44ae5e2b66fef
SHA256eef8937445f24c2bcbe101419be42694e0e38628653a755ab29ecba357d81d48
SHA512d04f2ab14ad4d3e06ea357b4c810515d73b32f2650533a5895ebf5d14b4b697752f25c0c371372e00faab661c0b051c33b8c25bf1226f30be5d6b8727dea81e1