Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 15:16
Behavioral task
behavioral1
Sample
749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe
-
Size
2.1MB
-
MD5
749603f5b4722486d3edc9b9c28efd3c
-
SHA1
19567d04b5f5af0a2ad9d09e01c1d69669e33f65
-
SHA256
7911777c3a33bb63b79e7ddec1a6487ccd6174dc8640693bd3d914033aa53a32
-
SHA512
443d6e341b189bbfe56132f797caa9002d35f78c1cc91d09014919ff27e5a6aa8318db31f0eee37ab178c2fc13e320bcc3880c8dd267c2c63fa1c2f9d09dbc99
-
SSDEEP
49152:5D451WwjP+GD3hNinchbucMiHNM2o+VX/sXyie+W6kVEUP5thtS:5Dx2PpROchbLM67FGyieV6kVEUdt
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\atapi.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\EhStorTcgDrv.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\MTConfig.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rhproxy.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\storufs.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\UcmTcpciCx.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\acpitime.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\Acx01000.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ibbus.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\UcmCx.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\HyperVideo.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\nvdimm.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\intelide.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ItSas35i.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\raspptp.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\ucx01000.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\ufxsynopsys.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vpci.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\circlass.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_GPIO2_CNL.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\vsmraid.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\WinUSB.SYS 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\nvstor.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\USBXHCI.SYS 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSSi_I2C.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\IPMIDrv.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\rdpvideominiport.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\fdc.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C_CNL.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\dmvsc.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\Null.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\tsusbhub.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdi2c.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdsata.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\BTHMINI.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\megasas35i.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\usbprint.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hyperkbd.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\tunnel.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdk8.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\kbdhid.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\usbccgp.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\usbuhci.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\CAD.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\pciide.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iaStorV.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\xinputhid.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\BthA2dp.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\bthmodem.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\lsi_sas3i.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\ndistapi.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\sfloppy.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\system32\drivers\speeder.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\errdev.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\Drivers\mshwnclx.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\iagpio.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\DRIVERS\NDProxy.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\parport.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\BthEnum.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\hidbth.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\sdstor.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\xboxgip.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\drivers\amdxata.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4852-0-0x0000000000400000-0x00000000008A9000-memory.dmp vmprotect behavioral2/memory/4852-1-0x0000000000400000-0x00000000008A9000-memory.dmp vmprotect behavioral2/memory/4852-5-0x0000000000400000-0x00000000008A9000-memory.dmp vmprotect -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\UEFI.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\UfxChipidea.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4852 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe 4852 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4852