Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 02:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe
-
Size
154KB
-
MD5
ce798e2c324b5bf04070f1be67e47b0b
-
SHA1
80923bc8855fd451e55d671c0aff74a70b89445d
-
SHA256
ef20fd970e9e8895144be974d47278ada59734018aa3c65ac4b6b93667c563ac
-
SHA512
a2b0c7102643149e120ed464db29ca60c4ba39f7719e79194dc3ae1acadaabb740ec638be108d3805a605ab78d2c6c786df44c065f36ab8d6b0ebd3211d6be67
-
SSDEEP
3072:nqQyrDQ/3dGPKHa8FopthQh4v8wzCKZcVFJc6ZRpTyCCae9:q38GPK6YoptPteKZcXKayfak
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 203.116.76.38 Destination IP 203.169.235.141 Destination IP 203.129.112.208 Destination IP 143.166.224.3 Destination IP 203.192.158.21 Destination IP 203.201.171.216 Destination IP 203.67.218.189 Destination IP 206.114.174.10 Destination IP 205.242.187.235 Destination IP 203.75.218.190 Destination IP 203.29.41.212 Destination IP 203.67.218.189 Destination IP 203.192.158.21 Destination IP 203.75.218.190 Destination IP 203.61.72.147 Destination IP 211.5.1.217 Destination IP 64.72.112.228 Destination IP 205.242.187.235 Destination IP 205.242.187.235 Destination IP 203.169.235.141 Destination IP 202.248.20.156 Destination IP 203.36.80.35 Destination IP 195.70.36.79 Destination IP 202.248.20.156 Destination IP 202.153.97.130 Destination IP 203.240.114.117 Destination IP 203.61.72.147 Destination IP 203.7.37.220 Destination IP 203.82.249.148 Destination IP 203.31.198.223 Destination IP 202.153.97.130 Destination IP 203.75.218.190 Destination IP 212.47.13.226 Destination IP 203.36.80.35 Destination IP 203.82.249.148 Destination IP 203.49.85.14 Destination IP 203.62.131.18 Destination IP 203.87.232.2 Destination IP 143.166.224.3 Destination IP 203.250.33.201 Destination IP 203.39.111.28 Destination IP 202.153.97.2 Destination IP 206.114.174.10 Destination IP 203.183.246.174 Destination IP 203.82.249.148 Destination IP 212.47.13.226 Destination IP 202.153.97.130 Destination IP 203.100.163.38 Destination IP 203.236.99.164 Destination IP 203.49.85.14 Destination IP 203.192.229.20 Destination IP 203.93.19.62 Destination IP 203.208.75.106 Destination IP 203.39.111.28 Destination IP 203.192.34.191 Destination IP 131.94.205.10 Destination IP 203.29.41.212 Destination IP 203.204.188.247 Destination IP 203.115.163.205 Destination IP 203.209.79.138 Destination IP 206.114.174.10 Destination IP 203.116.76.38 Destination IP 203.41.164.85 Destination IP 203.200.141.75 -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 62 IoCs
pid Process 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe 972 ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce798e2c324b5bf04070f1be67e47b0b_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:972