Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21-08-2024 21:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe
-
Size
360KB
-
MD5
b5273a0163c71fcad373632402716d6d
-
SHA1
ec6fb6cda84c718abfc23ad6176c09bb5d0c3ea1
-
SHA256
c5945445ce7edd6dd33a730a4c1bcf6b4d42b2f3e451d9e69e968b67cd40f320
-
SHA512
5ad7cb8d2721968d532cb33b2a65abf2f19c02ba12f0fb0326926320d60dfaf10705b84464f9096be83e60718d3fc01667e8649dd628691dc4ab2fe09836fa98
-
SSDEEP
6144:eCAt/ABfs18svlnkczR/MurAXIEAykBnFq/N5tRJoRkSdkalPjavSQot5KP6G:ehMfQ8svlkKtIXIz52J8jdpiSQonKP3
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rundll32.exe -
Disables Task Manager via registry modification
-
Modifies Shared Task Scheduler registry keys 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler 1_dropper_286962.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler\IPC Configuration Utility = "IPC Configuration Utility" 1_dropper_286962.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler\{020487CC-FC04-4B1E-863F-D9801796230B} = "Windows Installer Class" rundll32.exe -
Executes dropped EXE 4 IoCs
pid Process 1352 1_dropper_286962.exe 2208 2_load.exe 2224 4_odb.exe 2264 3_baracudanew.exe -
Loads dropped DLL 19 IoCs
pid Process 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 2732 WerFault.exe 2732 WerFault.exe 2732 WerFault.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2732 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2732 2224 WerFault.exe 34 2588 2264 WerFault.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4_odb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1_dropper_286962.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3_baracudanew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2_load.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Desktop\General rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" rundll32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{020487CC-FC04-4B1E-863F-D9801796230B} 1_dropper_286962.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{020487CC-FC04-4B1E-863F-D9801796230B}\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wndutl32.dll" 1_dropper_286962.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{020487CC-FC04-4B1E-863F-D9801796230B}\Apartment = "Apartment" 1_dropper_286962.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{020487CC-FC04-4B1E-863F-D9801796230B}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wndutl32.dll" rundll32.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe 2696 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2224 4_odb.exe 2224 4_odb.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2340 wrote to memory of 1352 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 31 PID 2340 wrote to memory of 1352 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 31 PID 2340 wrote to memory of 1352 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 31 PID 2340 wrote to memory of 1352 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 31 PID 2340 wrote to memory of 2208 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 32 PID 2340 wrote to memory of 2208 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 32 PID 2340 wrote to memory of 2208 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 32 PID 2340 wrote to memory of 2208 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 32 PID 2340 wrote to memory of 2264 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 33 PID 2340 wrote to memory of 2264 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 33 PID 2340 wrote to memory of 2264 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 33 PID 2340 wrote to memory of 2264 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 33 PID 2340 wrote to memory of 2224 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 34 PID 2340 wrote to memory of 2224 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 34 PID 2340 wrote to memory of 2224 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 34 PID 2340 wrote to memory of 2224 2340 b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe 34 PID 2224 wrote to memory of 2732 2224 4_odb.exe 35 PID 2224 wrote to memory of 2732 2224 4_odb.exe 35 PID 2224 wrote to memory of 2732 2224 4_odb.exe 35 PID 2224 wrote to memory of 2732 2224 4_odb.exe 35 PID 1352 wrote to memory of 2696 1352 1_dropper_286962.exe 36 PID 1352 wrote to memory of 2696 1352 1_dropper_286962.exe 36 PID 1352 wrote to memory of 2696 1352 1_dropper_286962.exe 36 PID 1352 wrote to memory of 2696 1352 1_dropper_286962.exe 36 PID 1352 wrote to memory of 2696 1352 1_dropper_286962.exe 36 PID 1352 wrote to memory of 2696 1352 1_dropper_286962.exe 36 PID 1352 wrote to memory of 2696 1352 1_dropper_286962.exe 36 PID 2264 wrote to memory of 2588 2264 3_baracudanew.exe 37 PID 2264 wrote to memory of 2588 2264 3_baracudanew.exe 37 PID 2264 wrote to memory of 2588 2264 3_baracudanew.exe 37 PID 2264 wrote to memory of 2588 2264 3_baracudanew.exe 37 PID 2208 wrote to memory of 1488 2208 2_load.exe 38 PID 2208 wrote to memory of 1488 2208 2_load.exe 38 PID 2208 wrote to memory of 1488 2208 2_load.exe 38 PID 2208 wrote to memory of 1488 2208 2_load.exe 38 -
System policy modification 1 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b5273a0163c71fcad373632402716d6d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\1_dropper_286962.exe"C:\Users\Admin\AppData\Local\Temp\1_dropper_286962.exe"2⤵
- Modifies Shared Task Scheduler registry keys
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\wndutl32.dll,load3⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Modifies Shared Task Scheduler registry keys
- Loads dropped DLL
- Windows security modification
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
PID:2696
-
-
-
C:\Users\Admin\AppData\Local\Temp\2_load.exe"C:\Users\Admin\AppData\Local\Temp\2_load.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\2_load.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1488
-
-
-
C:\Users\Admin\AppData\Local\Temp\3_baracudanew.exe"C:\Users\Admin\AppData\Local\Temp\3_baracudanew.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 883⤵
- Loads dropped DLL
- Program crash
PID:2588
-
-
-
C:\Users\Admin\AppData\Local\Temp\4_odb.exe"C:\Users\Admin\AppData\Local\Temp\4_odb.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 3003⤵
- Loads dropped DLL
- Program crash
PID:2732
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Indicator Removal
1File Deletion
1Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD538afda4effa4cb8a29e8e5b8af91b1e5
SHA1cd2611d911c37dc68525bc36b24fb69e6cea6f34
SHA2568377f14adcb98d8af8e70d74642afc09b6e72cf56aa55d734aafadc41596a317
SHA51283422717402beb076d0177db43e0b99a9da863584a88fc6afdfe80f4d3872976497c4b295a5f81f649ddb0c249a8a4de34ea6af292e0099c6f3b3ddb980e519e
-
Filesize
229KB
MD55ed2d74e842d4c01b6ae7ef42e068980
SHA18158cc4dec022ddb7ac3638c6565b239fb476ad3
SHA25673c8370664d9b28d14efcdf705c4195edcd560083fcf6f2ab8f5a74b2f899814
SHA51273ce80fbcf9db42b2d6d01d4b724ee39a118a7cf6996fcd34b04f14f4e3a89de1df891438dcca534e9ac71f40bd441ae7b31a47dffc7844bf28b5b1a79980b83
-
Filesize
12KB
MD5ee5164fc77d90baa439616fd8b7c8fe1
SHA175532c4d73fb437b7d863089a01276207f17e872
SHA25617c729128efb050a4ed4cc5cd9127c2f65696f9a81b3057e9a2899fe47eeb9c4
SHA512d3f07bd89fd0e0168601002d976c76e50eadaad0ce3f756143a36147c20690aa6459afc72b6f8389a3f7f605d1beacb1246df7212498e20130c6cbcfbff8a0b5
-
Filesize
48KB
MD53e353f7e256abe626507680900efba77
SHA1119bdbb3035e3b17658c8992585acde7804c8050
SHA2560f404bc8550f8c66c922b23a1f94137915bb443f824149fff9d8baf7358e80fa
SHA5127179e571b276e32c189797e96cd53d4d51997e0c20ffd539ac78f1b0049fb33a5db61dc9de4a8d68ee024fee9dc6263e11b99fe80b4398e87c585742a6533d1c
-
Filesize
40KB
MD542ff43f14d6ba7503644c0e6e196239a
SHA13bccdc80fcc52723af4e1b9adf7383b616abfdb6
SHA256dcb7130ebd624181ecef49e61b1e4bac01380bc52d5373a439108e1d8478f8ac
SHA512b39d58a7f089113937e3087ad1dff2e04112c977d3d518678cf99b972ef65af7700906bbd3a377e05820c0095b8aa3244d536a451c54b991742d24981db83408