Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-08-2024 11:18
Static task
static1
Behavioral task
behavioral1
Sample
85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe
-
Size
728KB
-
MD5
85da44423ed342a7f011acfe8c515cea
-
SHA1
468a7ad4adebda47ddb46f22f1c16276030c0ad1
-
SHA256
d0b45069c875d9a82738b035552e2d8ea3e2a98e2d6138d9db11b5b680c519a8
-
SHA512
e26b46c18d2d5dfd860bd646f2bc11b438219f8c361156dada5d397c9e0262ea3c35dcee4b92def208fc7be59dfc74d8f24758f52edfd2eb0df15be160cd3480
-
SSDEEP
12288:1JYu0cCcKtLszw0EVga2WMuCE97NNDHiujDgt5plQs0Y9BMSEn6:uckLJ79JJHiuwLV3KSEn
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1826CDB1-DCCF-490E-89C8-C722F9CF83C1}\InprocServer32\ = "%SystemRoot%\\SysWow64\\sysmon.ocx" 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1826CDB1-DCCF-490E-89C8-C722F9CF83C1}\InprocServer32\ThreadingModel = "Apartment" 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1826CDB1-DCCF-490E-89C8-C722F9CF83C1} 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1826CDB1-DCCF-490E-89C8-C722F9CF83C1}\ = "System Monitor Source Properties" 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1826CDB1-DCCF-490E-89C8-C722F9CF83C1}\InprocServer32 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 548 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 548 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 548 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe 548 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe 548 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe 548 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1052 wrote to memory of 548 1052 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe 30 PID 1052 wrote to memory of 548 1052 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe 30 PID 1052 wrote to memory of 548 1052 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe 30 PID 1052 wrote to memory of 548 1052 85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\85da44423ed342a7f011acfe8c515cea_JaffaCakes118.exe"2⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:548
-