Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 03:54
Static task
static1
Behavioral task
behavioral1
Sample
10a326b5129bb5555c17bcf24be84ed2_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
10a326b5129bb5555c17bcf24be84ed2_JaffaCakes118.dll
-
Size
220KB
-
MD5
10a326b5129bb5555c17bcf24be84ed2
-
SHA1
bc9936d0271fde73718e35b9047116b112491c56
-
SHA256
3a63d9c2f444d5e1676d113e1f4990dbb16065ea5eef628db756038040c2ac3a
-
SHA512
4763eafbed3aab6de1b3155a3046e811342dc8dec0be7681379f382ce195bdab9cb34173e2350079d82ca1c252b4acfb6a22d611da55ebf5b06d2f45207237e6
-
SSDEEP
3072:dgU1b4jxZTxLFgXr3LjJqo0Ktde/3Jvmc/BsCpCc9v/rRgoF3mwzi8EPELGNMe:Z4xhor79ts/3Jvmcqi9Leo5mRJELkR
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation rundll32mgr.exe -
Executes dropped EXE 2 IoCs
pid Process 2580 rundll32mgr.exe 4176 unrmeyrklplnbvym.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\VIA\Setup\viasetup.log rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 452 2268 WerFault.exe 85 3208 2676 WerFault.exe 102 -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115132" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115132" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2557916706" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115132" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2756042618" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2555729376" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2557916706" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2555729376" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C3F7B5D6-336F-11EF-B1BC-D685EB24A7F4} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426139034" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115132" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115132" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 2580 rundll32mgr.exe Token: SeDebugPrivilege 2580 rundll32mgr.exe Token: SeSecurityPrivilege 4176 unrmeyrklplnbvym.exe Token: SeLoadDriverPrivilege 4176 unrmeyrklplnbvym.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3152 IEXPLORE.EXE 3152 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3152 IEXPLORE.EXE 3152 IEXPLORE.EXE 3140 IEXPLORE.EXE 3140 IEXPLORE.EXE 3140 IEXPLORE.EXE 3140 IEXPLORE.EXE 3152 IEXPLORE.EXE 3152 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 4660 wrote to memory of 2560 4660 rundll32.exe 83 PID 4660 wrote to memory of 2560 4660 rundll32.exe 83 PID 4660 wrote to memory of 2560 4660 rundll32.exe 83 PID 2560 wrote to memory of 2580 2560 rundll32.exe 84 PID 2560 wrote to memory of 2580 2560 rundll32.exe 84 PID 2560 wrote to memory of 2580 2560 rundll32.exe 84 PID 2580 wrote to memory of 2268 2580 rundll32mgr.exe 85 PID 2580 wrote to memory of 2268 2580 rundll32mgr.exe 85 PID 2580 wrote to memory of 2268 2580 rundll32mgr.exe 85 PID 2580 wrote to memory of 2268 2580 rundll32mgr.exe 85 PID 2580 wrote to memory of 2268 2580 rundll32mgr.exe 85 PID 2580 wrote to memory of 2268 2580 rundll32mgr.exe 85 PID 2580 wrote to memory of 2268 2580 rundll32mgr.exe 85 PID 2580 wrote to memory of 2268 2580 rundll32mgr.exe 85 PID 2580 wrote to memory of 2268 2580 rundll32mgr.exe 85 PID 2580 wrote to memory of 3552 2580 rundll32mgr.exe 99 PID 2580 wrote to memory of 3552 2580 rundll32mgr.exe 99 PID 2580 wrote to memory of 3552 2580 rundll32mgr.exe 99 PID 3552 wrote to memory of 3152 3552 iexplore.exe 100 PID 3552 wrote to memory of 3152 3552 iexplore.exe 100 PID 3152 wrote to memory of 3140 3152 IEXPLORE.EXE 101 PID 3152 wrote to memory of 3140 3152 IEXPLORE.EXE 101 PID 3152 wrote to memory of 3140 3152 IEXPLORE.EXE 101 PID 2580 wrote to memory of 2676 2580 rundll32mgr.exe 102 PID 2580 wrote to memory of 2676 2580 rundll32mgr.exe 102 PID 2580 wrote to memory of 2676 2580 rundll32mgr.exe 102 PID 2580 wrote to memory of 2676 2580 rundll32mgr.exe 102 PID 2580 wrote to memory of 2676 2580 rundll32mgr.exe 102 PID 2580 wrote to memory of 2676 2580 rundll32mgr.exe 102 PID 2580 wrote to memory of 2676 2580 rundll32mgr.exe 102 PID 2580 wrote to memory of 2676 2580 rundll32mgr.exe 102 PID 2580 wrote to memory of 2676 2580 rundll32mgr.exe 102 PID 2580 wrote to memory of 4632 2580 rundll32mgr.exe 106 PID 2580 wrote to memory of 4632 2580 rundll32mgr.exe 106 PID 2580 wrote to memory of 4632 2580 rundll32mgr.exe 106 PID 4632 wrote to memory of 4948 4632 iexplore.exe 107 PID 4632 wrote to memory of 4948 4632 iexplore.exe 107 PID 3152 wrote to memory of 1720 3152 IEXPLORE.EXE 108 PID 3152 wrote to memory of 1720 3152 IEXPLORE.EXE 108 PID 3152 wrote to memory of 1720 3152 IEXPLORE.EXE 108 PID 2580 wrote to memory of 4176 2580 rundll32mgr.exe 111 PID 2580 wrote to memory of 4176 2580 rundll32mgr.exe 111 PID 2580 wrote to memory of 4176 2580 rundll32mgr.exe 111
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10a326b5129bb5555c17bcf24be84ed2_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10a326b5129bb5555c17bcf24be84ed2_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:2268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 2045⤵
- Program crash
PID:452
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3152 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3140
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3152 CREDAT:17416 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:2676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 2125⤵
- Program crash
PID:3208
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
PID:4948
-
-
-
C:\Users\Admin\AppData\Local\Temp\unrmeyrklplnbvym.exe"C:\Users\Admin\AppData\Local\Temp\unrmeyrklplnbvym.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2268 -ip 22681⤵PID:1440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2676 -ip 26761⤵PID:4416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
114KB
MD51093158a93efd6a813e57ce647b81735
SHA1823a9d673b9083c3ddaedc69fb0583f97991457f
SHA25694646d45925b4cd6928646605f6c54e04f84136dc25f3f0914a53161f5a57ee1
SHA512f4d71ab354ce9ca4c2ab20633525f9be715ca8de1194e652c692415643cb609651c2e3a8edd4d3d5a28f4ca8c732eb9ff598c7e929f2deb46fa1b2509150d064