Analysis
-
max time kernel
92s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 02:24
Behavioral task
behavioral1
Sample
2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe
-
Size
505KB
-
MD5
2aa87ab5ce413830ff83425b4f6d14e1
-
SHA1
df013cd708885824b7ab72583c783684ccea93db
-
SHA256
f83177f58f95776bb644a41fb46f5fb6be1eb75102396c74f0195e82e2ca93d6
-
SHA512
bd5af7f527945ab0d96a39355b85deec0eb85f29ae39dc32cacf2cf7288e3cb6fe8566828a5163c7511cebf94eb29db1bbb3f085647f5741a4a0933b467fb646
-
SSDEEP
12288:LQIbwgQ/hahneoN8LwIQMQa1nkGf4RDzDVWiewOdDP0:t7QahnMLHZQa1nkGfZBD
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications regedit.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\system32\oobe\8010\svchost.exe = "C:\\Windows\\system32\\oobe\\8010\\svchost.exe:*:Enabled:svchost" regedit.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List regedit.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile regedit.exe -
Loads dropped DLL 1 IoCs
pid Process 4692 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{82FE757D-2859-454C-A4A3-D70416F731F8} regsvr32.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\GPBYUAESSQS.reg 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe File created C:\Windows\SysWOW64\42169a7e4d.dll 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\42169a7e4d.dll 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\8010\svchost.exe 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\tpjpwzbiye.dll 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\oobe\tpjpwzbiye.dll 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe -
Modifies registry class 41 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\ = "ExFlash" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tpjpwzbiye.GetFlash\Clsid\ = "{82FE757D-2859-454C-A4A3-D70416F731F8}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 4e00310000000000e858aa3b10006f6f626500003a0009000400efbe874fdb49e858aa3b2e000000ae1300000000010000000000000000000000000000007a3524016f006f0062006500000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8} regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tpjpwzbiye.GetFlash regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4e00310000000000e858aa3b10003830313000003a0009000400efbee858aa3be858aa3b2e00000053da01000000050000000000000000000000000000007efa28013800300031003000000014000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\ProgID regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5a00310000000000e858a93b100053797374656d33320000420009000400efbe874f7748e858a93b2e000000b90c0000000001000000000000000000000000000000ea7c6b00530079007300740065006d0033003200000018000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\InprocServer32\ = "C:\\Windows\\SysWow64\\oobe\\tpjpwzbiye.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tpjpwzbiye.GetFlash\ = "ExFlash" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\ProgID\ = "tpjpwzbiye.GetFlash" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5600310000000000e4587988100057696e646f777300400009000400efbe874f7748e858aa3b2e0000000006000000000100000000000000000000000000000058ddcf00570069006e0064006f0077007300000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FE757D-2859-454C-A4A3-D70416F731F8}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tpjpwzbiye.GetFlash\Clsid regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe -
Runs .reg file with regedit 1 IoCs
pid Process 312 regedit.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe Token: SeDebugPrivilege 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2288 explorer.exe 2288 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4780 wrote to memory of 2636 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 84 PID 4780 wrote to memory of 2636 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 84 PID 4780 wrote to memory of 2636 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 84 PID 4780 wrote to memory of 4692 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 87 PID 4780 wrote to memory of 4692 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 87 PID 4780 wrote to memory of 4692 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 87 PID 4780 wrote to memory of 4900 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 88 PID 4780 wrote to memory of 4900 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 88 PID 4780 wrote to memory of 4900 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 88 PID 4780 wrote to memory of 312 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 90 PID 4780 wrote to memory of 312 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 90 PID 4780 wrote to memory of 312 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 90 PID 4780 wrote to memory of 4624 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 91 PID 4780 wrote to memory of 4624 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 91 PID 4780 wrote to memory of 4624 4780 2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2aa87ab5ce413830ff83425b4f6d14e1_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cacls.execacls "C:\Windows\system32\oobe" /t /e /g everyone:f2⤵PID:2636
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s C:\Windows\system32\oobe\tpjpwzbiye.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4692
-
-
C:\Windows\SysWOW64\EXPLORER.EXEEXPLORER.EXE /e,C:\Windows\system32\oobe\8010\2⤵PID:4900
-
-
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /s "C:\Windows\system32\GPBYUAESSQS.reg"2⤵
- Modifies firewall policy service
- Runs .reg file with regedit
PID:312
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$306609.bat2⤵PID:4624
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182B
MD5dc5f20b89d0f2b11423ebfc368b5d288
SHA197e072ae0eb671206add8a167dd7d0ea7a62502f
SHA2564672f2ae6362dd096b60303106361ce34a6822fea8b23bc9afbccc6040bfcd33
SHA512b0258099a03921f6dbca5e74fd1572c3c162463c1498fdc1ea374490cea42a7b10469003ad0dceab09b914d7f3de6d9eca7524003b7b36fa4a7f5eca3f9c3be2
-
Filesize
139B
MD5293b2d016db4c3eef608b9c061093cd2
SHA1137bdda05b7597ed9d071a78618c03df519c9763
SHA2566c88b08eebe6228f005f39565c99fdf5d8a134d7d54288899e794ef5e8f76f94
SHA512a9b329d3e06a35d4e5cf7a16eb08690c2fa8f626f209f65aeb67e2db1317d0e4ce89e6dd5d9d2fd0c3bf3396030a0e950128fc3a3bfefe645e501327f5e3e246
-
Filesize
297B
MD599eacff177203b6f5128fe7d271857b2
SHA1a9a43c162c27bc4382957f2b22fb48b0dc17bbfc
SHA256d1d5136acd329ef64ce9877cd390727d94b9849bf4ae77e8d0cdd05780259b98
SHA5122df1be0702be6794081979abe953529c7968170c09349a3b6f4e66f643954dd2d5b1bc8cd233792313a322599177186c881c84bd5b974c2d0b816678d4e5fe03
-
Filesize
550KB
MD531bf4c2449568a7fa89301efd67dab86
SHA1a355a8d5b6cc40f447595b83ed806c57e012c1d2
SHA256c00d8b8f30f77f39ebdd7f2f70561c059259e23d85d6654f4cb0462af7a6c393
SHA512387af479a7cf4f5935bbb62863604d5e38a45aca97aeb2931770695f8c8e7fd8900446e9dad549a470faf3cc7146d168c1122a42060d8758b2b22f52624ad45f