Analysis
-
max time kernel
142s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 22:28
Static task
static1
Behavioral task
behavioral1
Sample
4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe
-
Size
420KB
-
MD5
4a4c2fafad27cbf16044476d97435107
-
SHA1
fe2bbacfc3de856b66e9845624cc4959c68993ef
-
SHA256
afcf1be0211a4861e3d623909d938bad4661dd5ae42e7949af63249709a388ea
-
SHA512
043e1424d155437293d8805a2b39de2690d192b884de39a1bb1f73d9c934aa8dbb7cdc0de6e7e10ce5e177a53b86fb4742aee3e11bb3501afa17e5d972a6bef7
-
SSDEEP
6144:A5PThKXOCIr/THcclUvDlHBB9qveGUnANsMhf64LhflMBq6Z0iclW:eThKbIr/SZHv4veGhfVLhP6Z0iS
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4576 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4576 explorer.exe 4576 explorer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2888 3024 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe 85 PID 3024 wrote to memory of 2888 3024 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe 85 PID 3024 wrote to memory of 2888 3024 4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a4c2fafad27cbf16044476d97435107_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" ::{20D04FE0-3AEA-1069-A2D8-08002B30309D}2⤵
- System Location Discovery: System Language Discovery
PID:2888
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4576