Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 02:14
Behavioral task
behavioral1
Sample
3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
3d3d222c524386051a66e0e986f97d16
-
SHA1
f86b87d976aa9dec28b84eca3fc33350c07020ff
-
SHA256
d218ba00936dea02fd2161f899870997eb919b55621d9b88adf4f557f8c3023d
-
SHA512
eb9590b1d8554aa12dd14e2ca0faec9e3670cb6bdd6e0c118148463214a1d40b499b107dfffb49e1148ee0b16a4309411f7585f7d48045a066ad6b42577415f5
-
SSDEEP
49152:oUz0QnDZBtducPSxAWr7ksSp2WuhkTCzF3KcfMBVuRhTmt9bfm9t:z0QnFdhqtr7kBYkTCt3MBghTmt9be9t
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\drivers\regtoro.sys 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\bord_007\ImagePath = "system32\\drivers\\regtoro.sys" 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2632-1-0x0000000000400000-0x00000000012D2000-memory.dmp aspack_v212_v242 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\Tcp_IP.exe" 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tcp_IP.exe 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe File opened for modification C:\Windows\Tcp_IP.exe 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2528 2632 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2336 reg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 8 IoCs
pid Process 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2052 2632 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe 30 PID 2632 wrote to memory of 2052 2632 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe 30 PID 2632 wrote to memory of 2052 2632 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe 30 PID 2632 wrote to memory of 2052 2632 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe 30 PID 2052 wrote to memory of 2336 2052 cmd.exe 32 PID 2052 wrote to memory of 2336 2052 cmd.exe 32 PID 2052 wrote to memory of 2336 2052 cmd.exe 32 PID 2052 wrote to memory of 2336 2052 cmd.exe 32 PID 2632 wrote to memory of 2528 2632 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe 33 PID 2632 wrote to memory of 2528 2632 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe 33 PID 2632 wrote to memory of 2528 2632 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe 33 PID 2632 wrote to memory of 2528 2632 3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3d3d222c524386051a66e0e986f97d16_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2336
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 5282⤵
- Program crash
PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2