Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 14:59
Behavioral task
behavioral1
Sample
868404328a2567d5441d169e0717c780_JaffaCakes118.exe
Resource
win7-20240704-en
6 signatures
150 seconds
General
-
Target
868404328a2567d5441d169e0717c780_JaffaCakes118.exe
-
Size
704KB
-
MD5
868404328a2567d5441d169e0717c780
-
SHA1
f08533fe58d51c93ed2a49ca8cea336660093c64
-
SHA256
aba7d621659f206f9dd7b5b5bfbf84c5f65ed70af564377e9756241cd1e4be09
-
SHA512
f2483cb311c69403d2188c2a6c1c03b8e7a286d3a9a6a7cacb5e9b1b50c26366799939ca69edc31003a4140d2a35ce3617e243b5c3bc33324d7ad3dbea281a1f
-
SSDEEP
12288:QG/jpPJvaWG99UC3NN91Xk+aiptW5v9edN1gFAbdY4OWt:b7pPuIqHi+qI+4O
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 868404328a2567d5441d169e0717c780_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/856-0-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/5104-2-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/5104-10-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/5104-11-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/856-15-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral2/memory/5104-17-0x0000000000400000-0x00000000004EF000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2096 5104 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 868404328a2567d5441d169e0717c780_JaffaCakes118.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\ = "Standard Picture" 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\CLSID 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\CLSID\ = "Standard Picture" 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\InprocServer32 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\InprocServer32\Assembly = "stdole, Version=7.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\InprocServer32\Class = "stdole.StdPictureClass" 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3} 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\InprocServer32\ = "C:\\Windows\\SysWOW64\\oleaut32.dll" 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\InprocServer32\RuntimeVersion = "v1.0.3705" 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\InprocServer32\ThreadingModel = "Apartment" 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\ProgID 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14C42A1-7DC8-045A-84D3-CD5EA159D4B3}\ProgID\ = "StdPicture" 868404328a2567d5441d169e0717c780_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 5104 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 5104 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Token: 33 5104 868404328a2567d5441d169e0717c780_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 5104 868404328a2567d5441d169e0717c780_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 856 wrote to memory of 5104 856 868404328a2567d5441d169e0717c780_JaffaCakes118.exe 86 PID 856 wrote to memory of 5104 856 868404328a2567d5441d169e0717c780_JaffaCakes118.exe 86 PID 856 wrote to memory of 5104 856 868404328a2567d5441d169e0717c780_JaffaCakes118.exe 86 PID 856 wrote to memory of 5104 856 868404328a2567d5441d169e0717c780_JaffaCakes118.exe 86 PID 856 wrote to memory of 5104 856 868404328a2567d5441d169e0717c780_JaffaCakes118.exe 86 PID 856 wrote to memory of 5104 856 868404328a2567d5441d169e0717c780_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\868404328a2567d5441d169e0717c780_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\868404328a2567d5441d169e0717c780_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\868404328a2567d5441d169e0717c780_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\868404328a2567d5441d169e0717c780_JaffaCakes118.exe"2⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 8883⤵
- Program crash
PID:2096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5104 -ip 51041⤵PID:3892