Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14-07-2024 07:36
Behavioral task
behavioral1
Sample
44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe
-
Size
161KB
-
MD5
44e4471cf202060cfdf697253119d5d9
-
SHA1
96417ad5385964e4f01e2a3e2c65b36c7f8593f0
-
SHA256
2f49803816e2ecfc6fedae550f419d292ce39e2a9530f28a4d187ea4cfd361c7
-
SHA512
83b2f020913cfbbce9376553f698fbff50bcd5e836cd818cef9dc5c87d41298bc0a224d852ac259c3c9577a4e45cf9ec1a6c2d57cb37bfb996852df76a3d5615
-
SSDEEP
3072:Q+BC3K5eqmhd+1OIKvxeeTl+V01w4NqfMSonoPZPFrqGws/iVudcs:4K7u1IPegG1Lq0SaGXrxlfW
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\MegaSas2i.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\MSKSSRV.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\scmbus.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\sisraid4.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\SmartSAMD.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\usbcir.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hwpolicy.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\HyperVideo.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\Null.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\raspptp.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rassstp.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\tunnel.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\acpipagr.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\BthEnum.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\terminpt.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hidspi.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\nvdimm.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\UcmUcsiAcpiClient.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iai2c.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rhproxy.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\Synth3dVsc.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\drmkaud.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\SiSRaid2.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaStorV.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\intelppm.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\mausbip.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\NdisImPlatform.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\ndiswan.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdxata.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\atapi.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rdpvideominiport.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\USBXHCI.SYS 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\msiscsi.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\WudfPf.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\pcmcia.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\TsUsbGD.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C_BXT_P.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\system32\DRIVERS\ramdisk.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vpci.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\bthhfenum.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\HpSAMD.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\tsusbhub.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vhf.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSSi_GPIO.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\processr.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\lsi_sas3i.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\Acx01000.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\applockerfltr.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\sdstor.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\netvsc.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\nvstor.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\SpatialGraphFilter.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\fdc.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_GPIO2.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vmbus.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaStorAVC.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\storufs.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\speeder.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\stornvme.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vmgid.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\megasr.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\qwavedrv.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\dmvsc.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4596-0-0x0000000000400000-0x000000000044D000-memory.dmp vmprotect behavioral2/memory/4596-2-0x0000000000400000-0x000000000044D000-memory.dmp vmprotect behavioral2/memory/4596-3-0x0000000000400000-0x000000000044D000-memory.dmp vmprotect -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\UEFI.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\UfxChipidea.sys 44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe