Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe
-
Size
264KB
-
MD5
4a3abd92faaeee0cbf47648b9f235140
-
SHA1
8b23873bc42746c2cdcc295dd221e07ddd27e177
-
SHA256
ab085e99a17a68e32f9c530278cf8a997ca9b7a9a9c3b951256acc37be5f6322
-
SHA512
940c33c3332d3d56b76fe0eab8545f801258caf58f7acaaaa6fabc1291efefc4179334390b76ab6a8a81452cf9a244d8e76b4768761769d7292ac64f35520a50
-
SSDEEP
6144:W5O8rS69xxY3hkm1ZDLZA3M7KrD37lSCVzhhy7:HBhGmvLZA3M7KrDJVI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1264 SeFastInstall2_3218.exe -
Loads dropped DLL 7 IoCs
pid Process 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 1264 SeFastInstall2_3218.exe 1264 SeFastInstall2_3218.exe 1264 SeFastInstall2_3218.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 SeFastInstall2_3218.exe -
resource yara_rule behavioral1/files/0x0008000000015d81-6.dat upx behavioral1/memory/1264-19-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-33-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-36-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-37-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-38-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-39-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-40-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-41-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-42-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-43-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-44-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-45-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-46-0x0000000000400000-0x00000000004AB000-memory.dmp upx behavioral1/memory/1264-47-0x0000000000400000-0x00000000004AB000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SeFastInstall2_3218.exe -
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\DefaultIcon 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\ShellFolder\Attributes = "0" 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\TypeLib 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7} 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\ = "Internet Explorer" 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\InfoTip = "Internet Explorer" 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\ShellFolder 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\DefaultIcon\ = "C:\\Windows\\SysWow64\\SHELL32.DLL,220" 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\Shell 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\Shell\Internet Explorer\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe http://www.pp2345.com" 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\TypeLib\ = "{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}" 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\Shell\Internet Explorer\Command 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABEE4922-5D43-4883-8E87-AC1AAC4F2DA7}\Shell\Internet Explorer 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1264 SeFastInstall2_3218.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1264 SeFastInstall2_3218.exe 1264 SeFastInstall2_3218.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1264 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 30 PID 2104 wrote to memory of 1264 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 30 PID 2104 wrote to memory of 1264 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 30 PID 2104 wrote to memory of 1264 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 30 PID 2104 wrote to memory of 1264 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 30 PID 2104 wrote to memory of 1264 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 30 PID 2104 wrote to memory of 1264 2104 4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a3abd92faaeee0cbf47648b9f235140_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe"C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5006bcf6d8e9bcda4ad8323f3622e245b
SHA145b88bd752ea8853a3aebf5779ae47666253251c
SHA2568854b97a765d20e2f15cc2da23bd78584bc3f67ec05a7e3f16020690f25d3821
SHA5124008fbce2719618acd2a4f852a601517935a018f56ff361c4c08a88fb1446f2e35652c8128ed86b313bd198966ffb8892c6ee7000132551d396dbcb40ba48ec0
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
20KB
MD58d8fdad7e153d6b82913f6fdc407d12c
SHA1aabbeed33cd5221e4cb22aab6e48310df94facfd
SHA256e727c8bba6686c4814602f2bc089af4b4cf3498d1dbe1a08d8c4732da5ba046b
SHA51242bc0ce1aca63904c34025307fd4b1d9f480ae47e42e7dfa48bbbf8286d947de2989435ad7a748951291307949217afeebcd31d10a1356c9366d3187085773a2
-
Filesize
8KB
MD5a7d710e78711d5ab90e4792763241754
SHA1f31cecd926c5d497aba163a17b75975ec34beb13
SHA2569b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
SHA512f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0