Analysis
- max time kernel
147s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
02/11/2024, 16:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe
- Size 22KB
- Sample241102-tqthmsskap
- SHA256 376b317fba6df18386eceddd523c6d5b80a7f9864b446e23032441777a8d9f16
- MD5 865b087271e7db3b9bf1037b35c4fae6
- SHA1 580f18b7b227d807661228bf62b7a0c0fdf6dc19
- SHA512 12f741b79782504f29217e26277a7d70b6ff27eda54984311fa02f1954f7c30d6adecdee99c30ee3e3cbda1577eeb667cd9d613d4ad76eb03cbe7a44b0f2100c
- SSDEEP 384:6SVKHuA12CRrG5T40jEf6WGbWVPDI0EXk8rFu7PszcJ52fp8qd/U0:JVA12eGNTjEf6WG2Ps0EX/HzCY2Ip
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe - Loads dropped DLL 1 IoCs
pid Process 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\9fd8db.drv 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\4BF9CBA3.cfg 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\4BF9CBA3.dll 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BF9CBA3-8DEE-41A1-8BDB-FC28D30E949F}\InprocServer32 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BF9CBA3-8DEE-41A1-8BDB-FC28D30E949F}\InprocServer32\ = "4BF9CBA3.dll" 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BF9CBA3-8DEE-41A1-8BDB-FC28D30E949F}\InprocServer32\ThreadingModel = "Apartment" 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLsID\{4BF9CBA3-8DEE-41A1-8BDB-FC28D30E949F}\InprocServer32 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLsID 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BF9CBA3-8DEE-41A1-8BDB-FC28D30E949F} 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe Token: SeDebugPrivilege 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 740 wrote to memory of 400 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 98 PID 740 wrote to memory of 400 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 98 PID 740 wrote to memory of 400 740 865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\865b087271e7db3b9bf1037b35c4fae6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\865B08~1.EXE >> NUL2⤵
- System Location Discovery: System Language Discovery
PID:400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\4BF9CBA3.dll
- Size 211KB
- SHA256 2fbd619a85190a63bd455ab736ba4646e4189a0148d82febf9f3dde3d0fab34c
- MD5 62b908603ecce9948892bea64296e3af
- SHA1 50e0a8a08205490233f0fb292d78f00718ab2ab9
- SHA512 a8f81e48f3cb7533fd247cc79089340e1d568cbb6d47b2ab39b2e0cb3f9615f596ebee79aadb3b013cc88ed24b28843d3aca0bc64794994cd7a4e958477965e1
- SSDEEP 384:/f6WGbWVPDI0EXk8rFu7PszcJ52fp8qd/UI:/f6WG2Ps0EX/HzCY2Ip
- MD5 SHA1 SHA512 SSDEEP