fa3f25ee2c2391baeea072e52a02b281cb08d32286ddae1c32661e225b970a3b

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
Size

1.3MB
MD5

e2cce01aab8cd586d0f64acc5a2e74e5
SHA1

e52f0ce5f6e87df8d5a1c58d44adae3f5e7b56bd
SHA256

fa3f25ee2c2391baeea072e52a02b281cb08d32286ddae1c32661e225b970a3b
SHA512

f7c310d92f78a1ab4171703e4a674ccc504bd79fdaeb0a8c954eb9eb029708039cd7353af92ed5e7669808bb1193f2a3ab8c68f95138f7cf74f18ad930047c4b
SSDEEP

24576:PdG6kjWH7if1plcLK99o5z6X/TMqsbtWzMci1PkeJizMf2Gmfdmr61r:VLk1IK99o5OYqy8Mt2ecYuHj1r

Score

8^/10

discovery evasion trojan

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\acpitime.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSS2i_GPIO2_CNL.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\nvraid.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\atapi.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\DRIVERS\ramdisk.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\rasl2tp.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSS2i_I2C_GLK.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\megasas35i.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\sbp2port.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\ufxsynopsys.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSS2i_I2C_BXT_P.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\stexstor.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\lsi_sss.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DRIVERS\rasacd.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\hidspi.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\vmstorfl.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\acpipagr.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\bthhfenum.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\hidir.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\MSPQM.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\ndfltr.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\Synth3dVsc.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\iaLPSS2i_GPIO2_GLK.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\CmBatt.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\EhStorTcgDrv.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\fdc.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\storufs.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\dam.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\vmbus.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\VMBusHID.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\DRIVERS\wdiwifi.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\lsi_sas2i.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\usbprint.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\WinUSB.SYS	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\Drivers\msgpioclx.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\intelpmax.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\Drivers\Null.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\ucx01000.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\HyperVideo.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\MSKSSRV.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\sisraid4.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\WdmCompanionFilter.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\Microsoft.Bluetooth.AvrcpTransport.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\rhproxy.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\iai2c.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\ibbus.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\Drivers\UcmUcsiCx.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DRIVERS\wanarp.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\flpydisk.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\Drivers\MsRPC.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\sfloppy.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\intelide.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\pcmcia.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\spaceparser.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\TsUsbGD.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\CAD.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\IPMIDrv.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\mshidkmdf.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\usbcir.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\wmiacpi.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\Drivers\mshwnclx.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\parport.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\speeder.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\uaspstor.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4948	~240631000.tmp.exe
3796	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\UEFI.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\UfxChipidea.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~240631000.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3796	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
3796	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4948	2076	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe	82
PID 2076 wrote to memory of 4948	2076	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe	82
PID 2076 wrote to memory of 4948	2076	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe	82
PID 2076 wrote to memory of 3796	2076	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe	83
PID 2076 wrote to memory of 3796	2076	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe	83
PID 2076 wrote to memory of 3796	2076	e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\~240631000.tmp.exe
  C:\Users\Admin\AppData\Local\Temp\~240631000.tmp.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4948
- C:\Users\Admin\AppData\Local\Temp\~240631000.tmp\e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\~240631000.tmp\e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~240631000.tmp.exe

Filesize
11KB

MD5
08232702cba0391d0ff4efec9961ba5a

SHA1
a93205772634d2a694312539ed03da1a9c1ef67f

SHA256
4ba4fbdb03ae978017fd045c5914474100ba64cc8bf78f7330f12e8700a2f7a2

SHA512
705ab1a08532d23913f83575ca32ad32f3f287ffcd20bfb60591d06f8615d16b272a382d9eb698674b7e5485b0585469a7637ca9ba770846785fc0c5669379af

Download Submit
C:\Users\Admin\AppData\Local\Temp\~240631000.tmp\e2cce01aab8cd586d0f64acc5a2e74e5_JaffaCakes118.exe

Filesize
1.2MB

MD5
7dafd2ba4daa08c0727804e39dc5fc34

SHA1
b05ce56b41b59ab1e75478f90d9d885cd4828d9a

SHA256
f44fedab49a9a3669b19dacfd482bb3fe661733da698f9fc39b4bd5ceaadd3ac

SHA512
23436b33e1305389c7663ec7b544a14b687ea25f40abccd7c535608560e93d9e5f913a79a64762b3490d65a0fb37cb7817405d8f707c895bd547a40c39f1b57a

Download Submit
memory/2076-0-0x0000000000400000-0x0000000000543000-memory.dmp

Filesize
1.3MB

Download
memory/2076-12-0x0000000000400000-0x0000000000543000-memory.dmp

Filesize
1.3MB

Download
memory/3796-13-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/3796-34-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/4948-7-0x0000000013140000-0x0000000013149000-memory.dmp

Filesize
36KB

Download
memory/4948-4-0x0000000013140000-0x0000000013149000-memory.dmp

Filesize
36KB

Download