Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 12:01
Static task
static1
Behavioral task
behavioral1
Sample
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe
-
Size
450KB
-
MD5
bba532743837f1a1aa5822ca50f4214e
-
SHA1
aa2b62b956b7644e5b69f8f0e50f15c5f4b3acee
-
SHA256
d0283d295817ddda8db5c4e65d3656ea824e93594a69ac04c2d3b30edc3ca561
-
SHA512
367180c881421b39f19bc45682ea67e4d4bd587961840cf7929dd79b01bf63c53d408fd92ea269cc4aa0abc0e9ef714d18fb08b17df1d88cfbf9ecebd3c37a17
-
SSDEEP
12288:zmNxAdISbFrvMM/h+VYFWPCZHBfe+lsYV3:zmkdTprvN/TFWPCVBWlYZ
Malware Config
Signatures
-
Modifies RDP port number used by Windows 1 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\International\Geo\Nation bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe" bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Antivirus = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe" bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Maps connected drives based on registry 3 TTPs 5 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\NextInstance bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Remote Services: SMB/Windows Admin Shares 1 TTPs 2 IoCs
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\LanmanServer\Parameters\NullSessionPipes bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Parameters\NullSessionPipes bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2812 2720 WerFault.exe regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exeregsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Nls\Language bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Nls\Language bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Nls\Language\InstallLanguage bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 64 IoCs
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Configuration Data bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Configuration Data bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\PreferredProfile bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Configuration Data bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Identifier bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Modifies registry class 3 IoCs
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exepid process 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exepid process 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exepid process 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exeregsvr32.exedescription pid process target process PID 2388 wrote to memory of 2720 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe regsvr32.exe PID 2388 wrote to memory of 2720 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe regsvr32.exe PID 2388 wrote to memory of 2720 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe regsvr32.exe PID 2388 wrote to memory of 2720 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe regsvr32.exe PID 2388 wrote to memory of 2720 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe regsvr32.exe PID 2388 wrote to memory of 2720 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe regsvr32.exe PID 2388 wrote to memory of 2720 2388 bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe regsvr32.exe PID 2720 wrote to memory of 2812 2720 regsvr32.exe WerFault.exe PID 2720 wrote to memory of 2812 2720 regsvr32.exe WerFault.exe PID 2720 wrote to memory of 2812 2720 regsvr32.exe WerFault.exe PID 2720 wrote to memory of 2812 2720 regsvr32.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Remote Services: SMB/Windows Admin Shares
- Writes to the Master Boot Record (MBR)
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\bba532743837f1a1aa5822ca50f4214e_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 2923⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Discovery
Query Registry
6System Information Discovery
6Peripheral Device Discovery
1System Location Discovery
1System Language Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2388-1-0x0000000000290000-0x00000000002C5000-memory.dmpFilesize
212KB
-
memory/2388-0-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-24-0x0000000000640000-0x0000000000646000-memory.dmpFilesize
24KB
-
memory/2388-23-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-22-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-21-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-20-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-19-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-18-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-17-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-16-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-15-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-14-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-13-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-12-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-11-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-10-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-9-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-8-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-7-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-6-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-5-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-4-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-3-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-2-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-30-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/2388-31-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2388-29-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2388-28-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2388-27-0x0000000000370000-0x0000000000374000-memory.dmpFilesize
16KB
-
memory/2388-26-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/2388-25-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/2388-33-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-34-0x0000000000290000-0x00000000002C5000-memory.dmpFilesize
212KB
-
memory/2388-35-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/2388-74-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-75-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-76-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-77-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-78-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-79-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-80-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-81-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-82-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-83-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/2388-84-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB