Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 21:45
Static task
static1
Behavioral task
behavioral1
Sample
109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe
-
Size
46KB
-
MD5
109cfc09fd1bf2dd9c1e05c681e5a7f7
-
SHA1
9c5d91f9ad9e1d14676e7ad194a72d9077d2ee77
-
SHA256
0a0f7f83fee9778a35af0d7ecc3ff7ecd99d365a659c1ed8da4804467f780a48
-
SHA512
8012e00d69acaf133aed58033bc1815650cab3330464fc7eab2f034bedb10110210bd6e23cb30af822c46038d08d39e993cf15f3a1a3b81a03cfb27963f77157
-
SSDEEP
768:pL70HBuggGV+NxR72o4kAwkVZVVIifk8XeaBx:pLjggGoxR72o4kKZVVkaBx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 848 DesktopLayer.exe -
resource yara_rule behavioral2/memory/3996-1-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/3996-5-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3996-7-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/848-9-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/848-8-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/848-11-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/848-12-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px7B4A.tmp 109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C671ED26-81D0-11EF-BFD9-76E8F1516C8A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135197" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135197" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135197" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2598699413" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2598699413" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2601199461" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434756890" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 848 DesktopLayer.exe 848 DesktopLayer.exe 848 DesktopLayer.exe 848 DesktopLayer.exe 848 DesktopLayer.exe 848 DesktopLayer.exe 848 DesktopLayer.exe 848 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 852 IEXPLORE.EXE 852 IEXPLORE.EXE 852 IEXPLORE.EXE 852 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3996 wrote to memory of 848 3996 109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe 82 PID 3996 wrote to memory of 848 3996 109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe 82 PID 3996 wrote to memory of 848 3996 109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe 82 PID 848 wrote to memory of 1992 848 DesktopLayer.exe 83 PID 848 wrote to memory of 1992 848 DesktopLayer.exe 83 PID 1992 wrote to memory of 852 1992 iexplore.exe 84 PID 1992 wrote to memory of 852 1992 iexplore.exe 84 PID 1992 wrote to memory of 852 1992 iexplore.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:852
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5109cfc09fd1bf2dd9c1e05c681e5a7f7
SHA19c5d91f9ad9e1d14676e7ad194a72d9077d2ee77
SHA2560a0f7f83fee9778a35af0d7ecc3ff7ecd99d365a659c1ed8da4804467f780a48
SHA5128012e00d69acaf133aed58033bc1815650cab3330464fc7eab2f034bedb10110210bd6e23cb30af822c46038d08d39e993cf15f3a1a3b81a03cfb27963f77157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD56de4427d02d49cee2c46a8fead1fafa8
SHA1bee49bf0e4452ca72442face8e655bf4a8c3af17
SHA25646d5cd7ff558e5c788807eb674587359c6a660cef091eb420676977e49833d53
SHA512c80311bb92f9f49de96d06e9a76a3ef0310365999f00f401fd003d438b66744a88f093b5887e1723c6b8179798697ec24c4b2bda489323337f6cec6d28ef6434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5302b76c575bbef3233c4669a4d3a92a9
SHA1c955f832c55c0d097f7706b6f8bed8ab0b57d228
SHA256220b62706230f7067f46990d53ff3049f68fa203e353658ef8ac642e00e60a8a
SHA512e1c6d04c0c94f36b3de57ccac272015b17f40d468253c0511aa4f18e6ff5a9e6b40ef30d4961aba764d0c55618eb4c8b64907400eba3ab2ab27a525b9efdf27c
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee