Analysis
- max time kernel
96s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/08/2024, 07:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
- Target c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe
- Size 160KB
- Sample240825-jfftpavark
- SHA256 6b583e82d5198e16aa6401b1b2c895fbb36bdbc29ea900b363aff65f2aba310a
- MD5 c040ffe82bf2807313cac6c91d726d97
- SHA1 914743d97e6494df09fc3b297ac07ede9eb96d8a
- SHA512 a90e9c713cc72bf04b0cde8798975042d0a9183f6f14fec34ff13d9039095f9c1cefcbd390c80f04f7cc979e0b37062f86efa045a78fa1a410566135a1866b33
- SSDEEP 3072:T0ACXtCQzFG1jcFjMwWQHwbM4IDmQavl0R:T0AUCs4FwWJg4IDmnvY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\dao.ico c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe - Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.ccc7.com" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.ccc7.com" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe - Modifies registry class 30 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\9 = "0" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D) c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\1 = "20240825" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pz c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\5 = "51" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8} c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R) c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.ccc7.com" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\9 = "1" c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M) c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O) c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3492 wrote to memory of 508 3492 c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe 84 PID 3492 wrote to memory of 508 3492 c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe 84 PID 3492 wrote to memory of 508 3492 c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\c040ffe82bf2807313cac6c91d726d97_JaffaCakes118.exe2⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.url
- Size 342B
- SHA256 ccd614a99b1cc6995f4d1e5b7ce6fa735ea5965d05e676f20ccba11393cef5be
- MD5 1a7a94ae60fda590bb97e9ed69a08b88
- SHA1 192fc32babb2e2f64e0787f05aaace1a9a544f11
- SHA512 0517bc96ff81f6f3ded3fb728f5ca723e4ad0f2c39bca47d6a28aa3ca108dcaa502fabaccb697e041d6e1a33c5804e59bd2189dcea1bed13297666a830cb33d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ÌÔ±¦ÌØÂô.url
- Size 347B
- SHA256 40a3d8ac06c7191adabc936f2809192d3fb88421f9509a8b8a5c82181b411005
- MD5 c0510927bb4b1821335e14fa0d90fc88
- SHA1 026ec30913b31f8cbd28261e25410da139763db8
- SHA512 327eaa26ffb776bda65720d39ee906ccfe38017fd39a3f9e46fa91559d231226eb408cee58fe88240607206e813f3aaf26e9bb730c35d36041cd1fbc26745053
- MD5 SHA1 SHA512