Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 15:38
Behavioral task
behavioral1
Sample
3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe
-
Size
762KB
-
MD5
3df58db5b49260f870c801257bd377b0
-
SHA1
99be6e76e4e7aaf6eb7c8640e02f9edcc558dce0
-
SHA256
8857c2962f47a745f243cdda7ded14a11540048a93146d8d2ca81192bff5cb93
-
SHA512
33586902b58c4180e69df9b2d7d3eaa70ca50065cf935eb35537a6b34960cef663054ee74c54e4bcea73af2ad54e2424fecda919e87e9c6f6f165a678ba0bd2f
-
SSDEEP
12288:RXIq8rbrA8S0VHrlPGUmGob5cjNVJe39su8okZp4:mRvA8ljecNA7W
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\vms3cap.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\vmbus.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\appid.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\processr.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\vhdmp.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\tcpipreg.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\bthmodem.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\gagp30kx.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\dmvsc.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\wacompen.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\ipfltdrv.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\MTConfig.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\ohci1394.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\usbuhci.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\rdprefmp.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\ql2300.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\sffdisk.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\WudfPf.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\amdk8.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\amdsata.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\HpSAMD.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\MSPCLOCK.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\parport.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\MSPQM.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\qwavedrv.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\synth3dvsc.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\BrFiltUp.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\cmdide.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\iaStorV.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\iirsp.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ipnat.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\umpass.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\serenum.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\uliagpkx.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\volmgrx.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\BrSerWdm.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\dxgkrnl.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\mpsdrv.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\ndiscap.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\ndisuio.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\isapnp.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\uagp35.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\viaide.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\msdsm.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\TsUsbGD.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\USBSTOR.SYS 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\rdpencdd.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\wanarp.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\RDPCDD.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\adpahci.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\nvraid.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\sermouse.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\sffp_mmc.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vwifibus.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\serial.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\peauth.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\agp440.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\irenum.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\lsi_fc.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\lsi_sas2.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rdpdr.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\lsi_scsi.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rdpvideominiport.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\tssecsrv.sys 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2632-0-0x0000000000400000-0x0000000000582000-memory.dmp vmprotect behavioral1/memory/2632-1-0x0000000000400000-0x0000000000582000-memory.dmp vmprotect behavioral1/memory/2632-8-0x0000000000400000-0x0000000000582000-memory.dmp vmprotect -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2632 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe 2632 3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3df58db5b49260f870c801257bd377b0_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632