Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 02:24
Behavioral task
behavioral1
Sample
2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
General
-
Target
2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe
-
Size
505KB
-
MD5
2aa87ab5ce413830ff83425b4f6d14e1
-
SHA1
df013cd708885824b7ab72583c783684ccea93db
-
SHA256
f83177f58f95776bb644a41fb46f5fb6be1eb75102396c74f0195e82e2ca93d6
-
SHA512
bd5af7f527945ab0d96a39355b85deec0eb85f29ae39dc32cacf2cf7288e3cb6fe8566828a5163c7511cebf94eb29db1bbb3f085647f5741a4a0933b467fb646
-
SSDEEP
12288:LQIbwgQ/hahneoN8LwIQMQa1nkGf4RDzDVWiewOdDP0:t7QahnMLHZQa1nkGfZBD
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List regedit.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\system32\oobe\3841\svchost.exe = "C:\\Windows\\system32\\oobe\\3841\\svchost.exe:*:Enabled:svchost" regedit.exe -
Deletes itself 1 IoCs
pid Process 2620 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2860 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{82FE757D-2859-454C-A4A3-D70416F731F8} regsvr32.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\oobe\pywnyxbiye.dll 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe File created C:\Windows\SysWOW64\UYYVHCKYINB.reg 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe File created C:\Windows\SysWOW64\cefd163f9a.dll 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cefd163f9a.dll 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\3841\svchost.exe 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\pywnyxbiye.dll 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 42 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pywnyxbiye.GetFlash\Clsid regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5600310000000000e858ab3b100053797374656d333200003e0008000400efbeee3a861ae858ab3b2a00000027090000000001000000000000000000000000000000530079007300740065006d0033003200000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 4a00310000000000e858af3b10006f6f62650000360008000400efbeee3a881ae858af3b2a0000003b0e00000000010000000000000000000000000000006f006f0062006500000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\InprocServer32 regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\ProgID regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4a00310000000000e858af3b1000333834310000360008000400efbee858af3be858af3b2a000000846801000000080000000000000000000000000000003300380034003100000014000000 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\InprocServer32\ = "C:\\Windows\\SysWow64\\oobe\\pywnyxbiye.dll" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5200310000000000e558894b100057696e646f7773003c0008000400efbeee3a851ae558894b2a0000008a020000000001000000000000000000000000000000570069006e0064006f0077007300000016000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pywnyxbiye.GetFlash\ = "ExFlash" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\pywnyxbiye.GetFlash regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\ = "ExFlash" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pywnyxbiye.GetFlash\Clsid\ = "{82FE757D-2859-454C-A4A3-D70416F731F8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\ProgID\ = "pywnyxbiye.GetFlash" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2776 regedit.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe Token: SeDebugPrivilege 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2532 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 30 PID 2352 wrote to memory of 2532 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 30 PID 2352 wrote to memory of 2532 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 30 PID 2352 wrote to memory of 2532 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 30 PID 2352 wrote to memory of 2860 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 32 PID 2352 wrote to memory of 2860 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 32 PID 2352 wrote to memory of 2860 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 32 PID 2352 wrote to memory of 2860 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 32 PID 2352 wrote to memory of 2860 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 32 PID 2352 wrote to memory of 2860 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 32 PID 2352 wrote to memory of 2860 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 32 PID 2352 wrote to memory of 2868 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 33 PID 2352 wrote to memory of 2868 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 33 PID 2352 wrote to memory of 2868 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 33 PID 2352 wrote to memory of 2868 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 33 PID 2352 wrote to memory of 1240 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 21 PID 2352 wrote to memory of 2776 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 36 PID 2352 wrote to memory of 2776 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 36 PID 2352 wrote to memory of 2776 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 36 PID 2352 wrote to memory of 2776 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 36 PID 2352 wrote to memory of 2620 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 37 PID 2352 wrote to memory of 2620 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 37 PID 2352 wrote to memory of 2620 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 37 PID 2352 wrote to memory of 2620 2352 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 37
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cacls.execacls "C:\Windows\system32\oobe" /t /e /g everyone:f3⤵PID:2532
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s C:\Windows\system32\oobe\pywnyxbiye.dll3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2860
-
-
C:\Windows\SysWOW64\EXPLORER.EXEEXPLORER.EXE /e,C:\Windows\system32\oobe\3841\3⤵PID:2868
-
-
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /s "C:\Windows\system32\UYYVHCKYINB.reg"3⤵
- Modifies firewall policy service
- Runs .reg file with regedit
PID:2776
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$306609.bat3⤵
- Deletes itself
PID:2620
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182B
MD5dc5f20b89d0f2b11423ebfc368b5d288
SHA197e072ae0eb671206add8a167dd7d0ea7a62502f
SHA2564672f2ae6362dd096b60303106361ce34a6822fea8b23bc9afbccc6040bfcd33
SHA512b0258099a03921f6dbca5e74fd1572c3c162463c1498fdc1ea374490cea42a7b10469003ad0dceab09b914d7f3de6d9eca7524003b7b36fa4a7f5eca3f9c3be2
-
Filesize
297B
MD550b72b2bed0059b588175eea41847159
SHA1619047964a309fe0741b1c7c3885a9be51830d6f
SHA256276e2d7e4ac745553ac271475eca94261ac496b6aa990f176efeda96c432fa5a
SHA512817ceaa59a8ef510eeef507a08d87af808748617e40d1c8eadda6daffed59a606ad4b1df3951fc4e1f981949e5c7fb733afbb141a47d15c45c935be535c224c1
-
Filesize
139B
MD547fb411888621e70f652d05864fcbe94
SHA18a49b7637ca70c58c8dab056d24cb55918700d19
SHA256c7fccc590282259046c29946fffb1f81e8bff6f4de23d59c294d6328c6d5466e
SHA512a49f182a7c21b49a607b3e66704205bce9b780c7d844ddd056122ac7121493a3d9e26be5b32b5fee782c6d60078862c6c82689df0fe4f392dc032b931f8df211
-
Filesize
550KB
MD531bf4c2449568a7fa89301efd67dab86
SHA1a355a8d5b6cc40f447595b83ed806c57e012c1d2
SHA256c00d8b8f30f77f39ebdd7f2f70561c059259e23d85d6654f4cb0462af7a6c393
SHA512387af479a7cf4f5935bbb62863604d5e38a45aca97aeb2931770695f8c8e7fd8900446e9dad549a470faf3cc7146d168c1122a42060d8758b2b22f52624ad45f