Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
82f63475190e543b9c5d79d24bd6e91d
-
SHA1
994fde79084e532203a1e473e71253a475598bb2
-
SHA256
62e216ea83a6de60dc7439dfbe521d8a3d37cd6f2917ba06edf2b0da2e3fdcf9
-
SHA512
dac98ca8409de3ed656d1ca106b1e31ec7e7d02c6fc55a3ef213872b5d7445f136adc6d7cc3a9118330e56ab3eff207c2a6dbf89b9817afd6e828682a8575375
-
SSDEEP
24576:jh5bXVxQ2CeV6vNJAp7ElVVwoRPyBlDSpAj6+Uip5BBNMd:t5rQ2MNHhwoRPQ+Aj6+U2q
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 1720 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2468 timeout.exe -
Modifies registry class 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\VersionIndependentProgID\ = "PortableDeviceValues.PortableDeviceValues" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\InprocServer32\ = "%systemroot%\\SysWow64\\PortableDeviceTypes.dll" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\InprocServer32\ThreadingModel = "Both" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\ProgID\ = "PortableDeviceValues.PortableDeviceValues.1" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\VersionIndependentProgID 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\TypeLib 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\TypeLib\ = "{2B00BA2F-E750-4beb-9235-97142EDE1D3E}" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\Version 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\Version\ = "1.0" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B} 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\ = "PortableDeviceValues Class" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\InprocServer32 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\ProgID 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2148 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2148 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1720 2148 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe 31 PID 2148 wrote to memory of 1720 2148 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe 31 PID 2148 wrote to memory of 1720 2148 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe 31 PID 2148 wrote to memory of 1720 2148 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe 31 PID 1720 wrote to memory of 2468 1720 cmd.exe 33 PID 1720 wrote to memory of 2468 1720 cmd.exe 33 PID 1720 wrote to memory of 2468 1720 cmd.exe 33 PID 1720 wrote to memory of 2468 1720 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 5 && del C:\Users\Admin\AppData\Local\Temp\82F634~1.EXE2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2468
-
-