Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-09-2024 17:54
Behavioral task
behavioral1
Sample
ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
General
-
Target
ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe
-
Size
55KB
-
MD5
ee2166b8636b702cb6ad74f693740d21
-
SHA1
b7837cda490ee29ebae1b138e2b1c51aa6ce5ae5
-
SHA256
64f14c276382a6c83ca4655b659a344af2481f8bbadfcaf17012cff9f026585f
-
SHA512
320c6e97724391d024cc30699d3612de9126770934dc4eca62aed48a666fb179b257aae9236e3a1187c289da1cc109d6c275e14e5dd945743c9115e07300c29e
-
SSDEEP
768:U4uctBneusEz+xwg8HC/6NETIjtOdKEpQNQmqulk25TVXGWS6+L3vOLDgM9jzSC8:R1Tenk+2jHNEWkY42Q8fTVzSl3vOLfp
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:Enabled:rundll32" rundll32.exe -
Drops file in Drivers directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DRIVERS\CompositeBus.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\flpydisk.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\wd.sys rundll32.exe File created C:\Windows\SysWOW64\Drivers\BrUsbSer.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\elxstor.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\partmgr.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\tssecsrv.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\1394ohci.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\lsi_sas.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\lsi_scsi.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\nfrd960.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\usbccgp.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\volsnap.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\dmvsc.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\errdev.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\HDAudBus.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\ndis.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\rdprefmp.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\MegaSR.sys rundll32.exe File created C:\Windows\SysWOW64\Drivers\Brserid.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\megasas.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\ql2300.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\rasacd.sys rundll32.exe File opened for modification C:\Windows\SysWOW64\drivers\1394ohci.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\atapi.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\vmbus.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\BrFiltLo.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\ndisuio.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\pciide.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\mpsdrv.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\pcmcia.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\qwavedrv.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\amdsbs.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\drmkaud.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\ipnat.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\kbdclass.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\mountmgr.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\SiSRaid2.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\wfplwf.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\raspptp.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\rdpdr.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\tsusbflt.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\b57nd60a.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\nv_agp.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\rspndr.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\sbp2port.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\TsUsbGD.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\mshidkmdf.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\MSPQM.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\storvsc.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\vga.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\ws2ifsl.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\BrFiltUp.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\peauth.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\tdpipe.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\evbda.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\nsiproxy.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\usbprint.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\HdAudio.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\IPMIDrv.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\processr.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\vsmraid.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\fdc.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\hidir.sys rundll32.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000015d47-6.dat acprotect -
Deletes itself 1 IoCs
pid Process 2324 rundll32.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\linkax.sys rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\linkax.sys\ = "Driver" rundll32.exe -
Loads dropped DLL 5 IoCs
pid Process 3024 ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe -
resource yara_rule behavioral1/memory/3024-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0008000000015d47-6.dat upx behavioral1/memory/3024-8-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2324-16-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2324-18-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2324-19-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/3024-20-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3024-22-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2324-232-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2324-233-0x0000000010000000-0x0000000010041000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} rundll32.exe -
Modifies WinLogon 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\linkap\DllName = "linkap.dll" ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\linkap\Startup = "linkap" ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\linkap\Impersonate = "1" ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\linkap\Asynchronous = "1" ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\linkap\MaxWait = "1" ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\linkap\nuag = f9e00cb0e68333c0b0f9e00c0000000000000000 ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\linkap ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mod_st.dat ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\chinastar.key rundll32.exe File opened for modification C:\Windows\SysWOW64\chinastar.key ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mod_st.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\a99k.bin ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe File created C:\Windows\SysWOW64\CLFS.sys rundll32.exe File created C:\Windows\SysWOW64\mod_st.dat ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe File created C:\Windows\SysWOW64\linkap.dll ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe File created C:\Windows\SysWOW64\linkax.sys ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\linkax.sys ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\pxysdb.dat rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1672 2324 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4F3C-8081-5663EE0C6C49} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2324 rundll32.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe 2324 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2324 3024 ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe 31 PID 3024 wrote to memory of 2324 3024 ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe 31 PID 3024 wrote to memory of 2324 3024 ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe 31 PID 3024 wrote to memory of 2324 3024 ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe 31 PID 3024 wrote to memory of 2324 3024 ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe 31 PID 3024 wrote to memory of 2324 3024 ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe 31 PID 3024 wrote to memory of 2324 3024 ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe 31 PID 2324 wrote to memory of 1672 2324 rundll32.exe 32 PID 2324 wrote to memory of 1672 2324 rundll32.exe 32 PID 2324 wrote to memory of 1672 2324 rundll32.exe 32 PID 2324 wrote to memory of 1672 2324 rundll32.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe linkap.dll,linkap C:\Users\Admin\AppData\Local\Temp\ee2166b8636b702cb6ad74f693740d21_JaffaCakes118.exe2⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Deletes itself
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 6003⤵
- Program crash
PID:1672
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Browser Extensions
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD55489130e7d7fc91bf6f1851a314debe8
SHA110293bf8d3a0e0ad1eb2e4e9ca1dae64e933e386
SHA256e3cff378c0550b53c02825aa488e06cdd6149c3e60fbf90e491979fe6371b2b8
SHA51227bfaa804a06e6e483b80ff9731a1ebe888d905a1cc6d8acdccefd17802d9173121d116b9eac3406b16364ac53fbdb49b34683df73b5f023744deb91fcddc9ff
-
Filesize
14KB
MD552692e5fb55ea8509fc327d3f0ba4860
SHA12e63c68d9dc9e36902ca606d242ec0fe2e3554e6
SHA256dc34ceade186993bedfb89d533cd007566d635eaad42c83d9563a531db968ad2
SHA5122e80bac87991812beec4fdce3a62a9069040d367cdad6a0472b4acc849f48ecf47a826a4a0ef583fb64a6364de9b578426e890ee6f1bacd3a47872f39004ba4a
-
Filesize
23KB
MD53fefeb19a84f953402a5c19274240c80
SHA1e380a2cc450ee81bff6164f44456179e4b514c72
SHA2563d08e0d24ffa4783f0218f59a04bb4ef12338c1d8627499b195e8d5abd4e97be
SHA51285e9fefad893e2c90aba33cca189a165ba33e62f1f312cf6304add017ed82d5ea24d1eff6c93c8b921cc198cbd154f347e568670bc78975dc15194430b0996eb