Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 22:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe
-
Size
26KB
-
MD5
bd70320e7e461bd644373c7ee9b385ae
-
SHA1
22c090e49d305d2254ae47bbf25e1aeb61e3a7d4
-
SHA256
041f381f32ab32960f0ca733243e766a537a80773665b3c9855e08625d0f53a8
-
SHA512
984b2cd7b8a8c5ca75e481772ce94470cb4d5ec2bd23970bf20b422db5155c08a770642496a492c0fb787c095487cc00288e2f1f22c5ad07c8da2b06d229817b
-
SSDEEP
768:mb1kNbf6EBlHKwTvtRL0aswhUMRwkkS6:U1kNbyEBBJJz/hHRwk
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.456t.com/index92.htm?id=00" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.456t.com/index92.htm?id=00" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe -
Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\shell\OpenHomePage\Command bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JE\shell\open bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.JE bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\shell\OpenHomePage bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.JE\ = "JE" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\tbhdz.ico" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JE\shell bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\shell\OpenHomePage\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE http://www.456t.com/index92.htm?id=00" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JE bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\ = "¿ì½Ý·½Ê½" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\shell bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\shell\OpenHomePage\ = "´ò¿ªÖ÷Ò³(&O)" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\DefaultIcon bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.IE bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JE\ = "¿ì½Ý·½Ê½" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JE\shell\open\command bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JE\shell\open\command\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE " bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE http://www.456t.com/index92.htm?id=00" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\open bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D} bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.IE\ = "IE" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon\ = "shdoclc.dll,0" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\open\command bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe Token: SeDebugPrivilege 440 bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd70320e7e461bd644373c7ee9b385ae_JaffaCakes118.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:440