Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 15:23
Static task
static1
Behavioral task
behavioral1
Sample
27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe
-
Size
237KB
-
MD5
27000663bafb3f68289c2332feabbbb1
-
SHA1
68f9adb85a0372067093b939cf6e002c36589e00
-
SHA256
50c30e379c8bbb67c727ab25813f8de0b8e699ac72557984c0a0d0f20b56766e
-
SHA512
d180c4a1065bb01f51f0cb938b34175fbc79401731e6dc6072da629768ea43ab365e44585ee7b6ccaf3768ebb56d9af3db24b97390afefb162b728f1a670ba9e
-
SSDEEP
3072:xrPlkw7Jk0o/0KI2QBJrzlyy6VoComIDPBeIg7qDHY7Cxyz+:xqwNkRHI2cHlyy6V2m3IdHUmh
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications igfxhk64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxhk64.exe = "C:\\Windows\\SysWOW64\\igfxhk64.exe:*:Enabled:Intel Help Console" igfxhk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List igfxhk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile igfxhk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications igfxhk64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxhk64.exe = "C:\\Windows\\SysWOW64\\igfxhk64.exe:*:Enabled:Intel Help Console" igfxhk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List igfxhk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile igfxhk64.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 1768 igfxhk64.exe -
Executes dropped EXE 2 IoCs
pid Process 2272 igfxhk64.exe 1768 igfxhk64.exe -
resource yara_rule behavioral2/memory/4660-0-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4660-2-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4660-3-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4660-4-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4660-38-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1768-43-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1768-44-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1768-45-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1768-46-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1768-47-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1768-48-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1768-54-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel Help Console = "C:\\Windows\\SysWOW64\\igfxhk64.exe" igfxhk64.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxhk64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxhk64.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxhk64.exe 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxhk64.exe 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxhk64.exe File opened for modification C:\Windows\SysWOW64\igfxhk64.exe igfxhk64.exe File opened for modification C:\Windows\SysWOW64\ 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 640 set thread context of 4660 640 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 93 PID 2272 set thread context of 1768 2272 igfxhk64.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4660 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 4660 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 4660 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 4660 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe 1768 igfxhk64.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 640 wrote to memory of 4660 640 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 93 PID 640 wrote to memory of 4660 640 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 93 PID 640 wrote to memory of 4660 640 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 93 PID 640 wrote to memory of 4660 640 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 93 PID 640 wrote to memory of 4660 640 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 93 PID 640 wrote to memory of 4660 640 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 93 PID 640 wrote to memory of 4660 640 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 93 PID 640 wrote to memory of 4660 640 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 93 PID 4660 wrote to memory of 2272 4660 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 94 PID 4660 wrote to memory of 2272 4660 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 94 PID 4660 wrote to memory of 2272 4660 27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe 94 PID 2272 wrote to memory of 1768 2272 igfxhk64.exe 95 PID 2272 wrote to memory of 1768 2272 igfxhk64.exe 95 PID 2272 wrote to memory of 1768 2272 igfxhk64.exe 95 PID 2272 wrote to memory of 1768 2272 igfxhk64.exe 95 PID 2272 wrote to memory of 1768 2272 igfxhk64.exe 95 PID 2272 wrote to memory of 1768 2272 igfxhk64.exe 95 PID 2272 wrote to memory of 1768 2272 igfxhk64.exe 95 PID 2272 wrote to memory of 1768 2272 igfxhk64.exe 95 PID 1768 wrote to memory of 3588 1768 igfxhk64.exe 56 PID 1768 wrote to memory of 3588 1768 igfxhk64.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27000663bafb3f68289c2332feabbbb1_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\igfxhk64.exe"C:\Windows\SysWOW64\igfxhk64.exe" C:\Users\Admin\AppData\Local\Temp\270006~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\igfxhk64.exe"C:\Windows\SysWOW64\igfxhk64.exe" C:\Users\Admin\AppData\Local\Temp\270006~1.EXE5⤵
- Modifies firewall policy service
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1768
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4100,i,18261153038209191383,10347744459236715365,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:81⤵PID:4072
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
237KB
MD527000663bafb3f68289c2332feabbbb1
SHA168f9adb85a0372067093b939cf6e002c36589e00
SHA25650c30e379c8bbb67c727ab25813f8de0b8e699ac72557984c0a0d0f20b56766e
SHA512d180c4a1065bb01f51f0cb938b34175fbc79401731e6dc6072da629768ea43ab365e44585ee7b6ccaf3768ebb56d9af3db24b97390afefb162b728f1a670ba9e