Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 03:32
Behavioral task
behavioral1
Sample
726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe
-
Size
405KB
-
MD5
726fb6ad8d4f2e3f0baa772716086b7d
-
SHA1
d7be333f1ad714bdcab8a4fd08355bd054b46299
-
SHA256
68309a50ec895bd2338f69540613d8001c6d6f54088377017c586f3095ceeb06
-
SHA512
1c6f221f27c9a0f42a28b6b6fdc42b6402924831297c77473567131cb051c6c83ca4a187a9966b4f0ca8dcab7ca38f1797bb64a2ed9ea231ae777e3838ad6821
-
SSDEEP
12288:iiGQKNNyxxNNNehbNeeeMo11eo3lVPAn1hL8UjB/YwX:iiGQKNNyxxNNNehbNeeeT11eDn1p8Uj9
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\iaLPSSi_I2C.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\NDKPing.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\Null.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\sfloppy.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\wanarp.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hidi2c.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hidinterrupt.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\SiSRaid2.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\tunnel.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\UcmUcsiCx.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\udecx.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\AcpiDev.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\usbaudio.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\HidBatt.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\usbuhci.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\serenum.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\umpass.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\sdstor.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdk8.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ipnat.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\ndisuio.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\netvsc.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vstxraid.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\Acx01000.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\buttonconverter.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\pcmcia.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\storvsc.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ADP80XX.SYS 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\MbbCx.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\MSTEE.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ufxsynopsys.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_GPIO2_CNL.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\ndistapi.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\serial.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_GPIO2.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C_GLK.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\intelpmax.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\megasas35i.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rdpvideominiport.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hidbth.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\msgpioclx.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaStorAVC.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\MsRPC.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rdpdr.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdxata.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\winmad.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\mausbhost.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\megasr.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\rasacd.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\storufs.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\EhStorTcgDrv.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\IPMIDrv.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\msiscsi.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\lsi_sas.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\qwavedrv.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\tsusbhub.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\mshwnclx.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\mshidkmdf.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\tsusbflt.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\bttflt.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\dmvsc.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\tpm.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\VMBusHID.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1304-0-0x0000000000400000-0x00000000004AD000-memory.dmp vmprotect behavioral2/memory/1304-1-0x0000000000400000-0x00000000004AD000-memory.dmp vmprotect behavioral2/memory/1304-5-0x0000000000400000-0x00000000004AD000-memory.dmp vmprotect -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\UEFI.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\UfxChipidea.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1304 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe 1304 726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\726fb6ad8d4f2e3f0baa772716086b7d_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1304