Analysis
-
max time kernel
140s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 22:28
Static task
static1
Behavioral task
behavioral1
Sample
4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe
-
Size
420KB
-
MD5
4a4c2fafad27cbf16044476d97435107
-
SHA1
fe2bbacfc3de856b66e9845624cc4959c68993ef
-
SHA256
afcf1be0211a4861e3d623909d938bad4661dd5ae42e7949af63249709a388ea
-
SHA512
043e1424d155437293d8805a2b39de2690d192b884de39a1bb1f73d9c934aa8dbb7cdc0de6e7e10ce5e177a53b86fb4742aee3e11bb3501afa17e5d972a6bef7
-
SSDEEP
6144:A5PThKXOCIr/THcclUvDlHBB9qveGUnANsMhf64LhflMBq6Z0iclW:eThKbIr/SZHv4veGhfVLhP6Z0iS
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1172 wrote to memory of 2892 1172 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe 30 PID 1172 wrote to memory of 2892 1172 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe 30 PID 1172 wrote to memory of 2892 1172 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe 30 PID 1172 wrote to memory of 2892 1172 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" ::{20D04FE0-3AEA-1069-A2D8-08002B30309D}2⤵
- System Location Discovery: System Language Discovery
PID:2892
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:2104