Malware Analysis Report

2024-12-07 14:30

Sample ID 241014-1f1mja1gqr
Target 444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118
SHA256 6f24b42fa836e33e871b11f2463962c08df3762b443bcdc46621d605e3826b0c
Tags
discovery exploit upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

6f24b42fa836e33e871b11f2463962c08df3762b443bcdc46621d605e3826b0c

Threat Level: Likely malicious

The file 444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery exploit upx

Possible privilege escalation attempt

Loads dropped DLL

Deletes itself

Modifies file permissions

Checks BIOS information in registry

Executes dropped EXE

UPX packed file

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-14 21:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-14 21:36

Reported

2024-10-14 21:38

Platform

win7-20240708-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe"

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft Help\MsHelpCenter.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft Help\thumbcache.db C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\MsHelpCenter.idx C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft Help\MsHelpCenter.idx C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\MsHelpCenter.exe C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft Help\MsHelpCenter.exe C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\thumbcache.db C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\RCX31C.tmp C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\_desktop.ini C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft Help\_desktop.ini C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\RCX35C.tmp C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\RCX3AB.tmp C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\RCX3BC.tmp C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft Help\MsHelpCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\bootsect.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft Help\MsHelpCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\takeown.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\software\microsoft\windows\Microsoft Help Center C:\Windows\Microsoft Help\MsHelpCenter.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\Microsoft Help Center\DatabaseIndex = "2" C:\Windows\Microsoft Help\MsHelpCenter.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\Microsoft Help Center\ContentHash = "470065006E006500720061006C00" C:\Windows\Microsoft Help\MsHelpCenter.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2468 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\Microsoft Help\MsHelpCenter.exe
PID 2468 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\Microsoft Help\MsHelpCenter.exe
PID 2468 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\Microsoft Help\MsHelpCenter.exe
PID 2468 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\Microsoft Help\MsHelpCenter.exe
PID 2468 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe
PID 2468 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe
PID 2468 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe
PID 2468 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe
PID 2740 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 296 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 296 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 296 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 296 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2740 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1948 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1948 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1948 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 1948 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2740 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\bootsect.exe
PID 2208 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\bootsect.exe
PID 2208 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\bootsect.exe
PID 2208 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\bootsect.exe
PID 2740 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2408 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2408 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2408 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 2740 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 1932 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 1932 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe
PID 1932 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe"

C:\Windows\Microsoft Help\MsHelpCenter.exe

"C:\Windows\Microsoft Help\MsHelpCenter.exe"

C:\Windows\Microsoft Help\MsHelpCenter.exe

"C:\Windows\Microsoft Help\MsHelpCenter.exe" -d C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.rar

C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "cmd.exe /c takeown /f C:\ldrscan\bootwin"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c takeown /f C:\ldrscan\bootwin

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\ldrscan\bootwin

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)"

C:\Windows\SysWOW64\icacls.exe

icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "C:\bootsect.exe /nt60 SYS /force"

C:\bootsect.exe

C:\bootsect.exe /nt60 SYS /force

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -upk"

C:\Windows\SysWOW64\cscript.exe

C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -upk

C:\Windows\SysWOW64\cmd.exe

cmd.exe /A /C "C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ipk D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV"

C:\Windows\SysWOW64\cscript.exe

C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -ipk D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV

Network

N/A

Files

\Windows\Microsoft Help\MsHelpCenter.exe

MD5 1fad509b9521d3787e0a0442a10d53e5
SHA1 144e232bb10467e6b8cdbc85b7c40d37f0f3e370
SHA256 dbe8b854f4b3e1b8e4d1c99c16b4e58de7cd52f0afd1f954562f39237c9a891a
SHA512 90775243ec813b5a340f3298a18d09b9c8546ea8db36dfebb3e2fb2f81b26f8b5dbc90699c3c8f97d31eda5e8f6a92b8218507c541a0c5eb2650990874c5cb39

C:\Users\Admin\AppData\Local\Temp\MsHelpCenter.pdb

MD5 dd4ba2d1b33e1e6d45ef343d1bfd7659
SHA1 11471d2dfd15e32c9881f97c4e3d6b61bde6b5b1
SHA256 cefd5c80b4e91860223da37664ea4cab5b6ee423b1f2e9b844fe52b18d2a9890
SHA512 ef0d93c50fa463b67b94b77e4d97ea6dcccc40648f8b5f3d3b0a72fad163af23c6d186183536559dd9e70ef8f4bc47319401fb72de9fa029705bebeb4142bc61

memory/2740-45-0x0000000000400000-0x0000000000623000-memory.dmp

memory/2468-43-0x0000000000BA0000-0x0000000000F19000-memory.dmp

memory/2740-47-0x0000000002440000-0x0000000002571000-memory.dmp

memory/2740-96-0x00000000008D0000-0x00000000008F0000-memory.dmp

memory/2740-88-0x00000000008C0000-0x00000000008D0000-memory.dmp

memory/2740-80-0x0000000000810000-0x0000000000820000-memory.dmp

memory/2740-72-0x00000000008A0000-0x00000000008B1000-memory.dmp

memory/2740-64-0x0000000010000000-0x0000000010021000-memory.dmp

memory/2740-56-0x0000000000800000-0x0000000000810000-memory.dmp

memory/2740-48-0x00000000007E0000-0x00000000007F1000-memory.dmp

memory/2740-105-0x0000000000400000-0x0000000000623000-memory.dmp

memory/2740-106-0x0000000000400000-0x0000000000623000-memory.dmp

C:\bootsect.exe

MD5 17b18a2feb3dcfe8a165af86ebc29fe7
SHA1 bf00a8ef28200a3bbc73633b360e1484ee2874d5
SHA256 99c4970f1f4b9dc50a5db9ff6f3a581754a1631f0751bdec2b5e3a261f35d85a
SHA512 034e809a3f2a2eaa633b7c1c9bffd0ac65041bf0a3fc6ba861e281712cdcb1e063d6c29e562bdc864e1963466ebcec9e30475907bea80a67ab48111ae583e65c

memory/2212-110-0x0000000001000000-0x000000000101B000-memory.dmp

memory/2740-111-0x0000000000400000-0x0000000000623000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-14 21:36

Reported

2024-10-14 21:38

Platform

win10v2004-20241007-en

Max time kernel

141s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe"

Signatures

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft Help\MsHelpCenter.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft Help\thumbcache.db C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft Help\MsHelpCenter.idx C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\RCX9ACB.tmp C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft Help\MsHelpCenter.exe C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\thumbcache.db C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\RCX99EE.tmp C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\_desktop.ini C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft Help\_desktop.ini C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\RCX9A6C.tmp C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\MsHelpCenter.idx C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\MsHelpCenter.exe C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\RCX9AEB.tmp C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft Help\RCX9AFC.tmp C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft Help\MsHelpCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft Help\MsHelpCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\software\microsoft\windows\Microsoft Help Center C:\Windows\Microsoft Help\MsHelpCenter.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Microsoft Help Center\DatabaseIndex = "2" C:\Windows\Microsoft Help\MsHelpCenter.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Microsoft Help Center\ContentHash = "470065006E006500720061006C00" C:\Windows\Microsoft Help\MsHelpCenter.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe"

C:\Windows\Microsoft Help\MsHelpCenter.exe

"C:\Windows\Microsoft Help\MsHelpCenter.exe"

C:\Windows\Microsoft Help\MsHelpCenter.exe

"C:\Windows\Microsoft Help\MsHelpCenter.exe" -d C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.rar

C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\444ba9a4cd4a8db90fce7f7f341de0aa_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\Windows\Microsoft Help\MsHelpCenter.exe

MD5 1fad509b9521d3787e0a0442a10d53e5
SHA1 144e232bb10467e6b8cdbc85b7c40d37f0f3e370
SHA256 dbe8b854f4b3e1b8e4d1c99c16b4e58de7cd52f0afd1f954562f39237c9a891a
SHA512 90775243ec813b5a340f3298a18d09b9c8546ea8db36dfebb3e2fb2f81b26f8b5dbc90699c3c8f97d31eda5e8f6a92b8218507c541a0c5eb2650990874c5cb39

C:\Users\Admin\AppData\Local\Temp\MsHelpCenter.pdb

MD5 dd4ba2d1b33e1e6d45ef343d1bfd7659
SHA1 11471d2dfd15e32c9881f97c4e3d6b61bde6b5b1
SHA256 cefd5c80b4e91860223da37664ea4cab5b6ee423b1f2e9b844fe52b18d2a9890
SHA512 ef0d93c50fa463b67b94b77e4d97ea6dcccc40648f8b5f3d3b0a72fad163af23c6d186183536559dd9e70ef8f4bc47319401fb72de9fa029705bebeb4142bc61

memory/3916-47-0x0000000000400000-0x0000000000623000-memory.dmp

memory/832-46-0x0000000000050000-0x00000000003C9000-memory.dmp

memory/3916-49-0x0000000002730000-0x0000000002861000-memory.dmp

memory/3916-50-0x0000000002560000-0x0000000002571000-memory.dmp

memory/3916-58-0x0000000000C60000-0x0000000000C70000-memory.dmp

memory/3916-66-0x0000000010000000-0x0000000010021000-memory.dmp

memory/3916-98-0x00000000026C0000-0x00000000026E0000-memory.dmp

memory/3916-90-0x00000000026B0000-0x00000000026C0000-memory.dmp

memory/3916-82-0x00000000026A0000-0x00000000026B0000-memory.dmp

memory/3916-74-0x0000000002680000-0x0000000002691000-memory.dmp

memory/3916-106-0x0000000000400000-0x0000000000623000-memory.dmp

memory/3916-108-0x0000000000400000-0x0000000000623000-memory.dmp

memory/3916-109-0x0000000000400000-0x0000000000623000-memory.dmp

memory/3916-110-0x0000000000400000-0x0000000000623000-memory.dmp

memory/3916-111-0x0000000000400000-0x0000000000623000-memory.dmp

memory/3916-112-0x0000000000400000-0x0000000000623000-memory.dmp

memory/3916-113-0x0000000000400000-0x0000000000623000-memory.dmp