Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 05:13
Static task
static1
Behavioral task
behavioral1
Sample
b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
b4f058ff3a9b018dff2d84422836e3f3
-
SHA1
2df2e6982a1171cf932956beb17db2e8214ff17d
-
SHA256
fb02d3051ba425240d34d9fe6901a48056a252948a55d1a2d40b1c81110e3ac3
-
SHA512
54708ae21f648103c37faeea506fdf8744018187e6d1bcf46d305680bf6a9a958fcf1d3dba42f0911306547d1ab0802d0d0febff32f9581e4aef6ec4527e9b10
-
SSDEEP
24576:ZUZaCTSu1iAjb/GCh2qWq+dl+vYurClThCob2FJLc5bSr5uhNY+jAAY:CFFjb/VEtwClcFRcaMNjI
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{670E4003-80D3-2GCE-D254-724055QA8Q0P} avast.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{670E4003-80D3-2GCE-D254-724055QA8Q0P}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\avast.exe\"" avast.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate avast.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion avast.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate a.exe -
Executes dropped EXE 4 IoCs
pid Process 1892 a.exe 2928 a.exe 2652 avast.exe 1984 avast.exe -
Loads dropped DLL 19 IoCs
pid Process 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 1892 a.exe 2928 a.exe 2928 a.exe 2928 a.exe 2928 a.exe 2928 a.exe 2928 a.exe 2652 avast.exe 2652 avast.exe 2652 avast.exe 2652 avast.exe 1984 avast.exe 1984 avast.exe 1984 avast.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Avast = "C:\\Users\\Admin\\AppData\\Roaming\\avast.exe" avast.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1892 set thread context of 2928 1892 a.exe 31 PID 2652 set thread context of 1984 2652 avast.exe 34 -
resource yara_rule behavioral1/memory/1892-27-0x0000000000310000-0x0000000000321000-memory.dmp upx behavioral1/memory/1892-26-0x0000000000310000-0x0000000000321000-memory.dmp upx behavioral1/memory/1892-25-0x0000000000310000-0x0000000000321000-memory.dmp upx behavioral1/memory/1892-24-0x0000000000310000-0x0000000000321000-memory.dmp upx behavioral1/memory/1892-23-0x0000000000310000-0x0000000000321000-memory.dmp upx behavioral1/memory/1892-29-0x0000000000330000-0x0000000000368000-memory.dmp upx behavioral1/memory/1892-28-0x0000000000330000-0x0000000000368000-memory.dmp upx behavioral1/memory/1892-56-0x0000000000310000-0x0000000000321000-memory.dmp upx behavioral1/memory/1892-60-0x0000000000330000-0x0000000000368000-memory.dmp upx behavioral1/memory/2652-115-0x0000000000950000-0x0000000000988000-memory.dmp upx behavioral1/memory/2652-114-0x0000000000930000-0x0000000000941000-memory.dmp upx behavioral1/memory/2652-113-0x0000000000930000-0x0000000000941000-memory.dmp upx behavioral1/memory/2652-112-0x0000000000930000-0x0000000000941000-memory.dmp upx behavioral1/memory/2652-111-0x0000000000930000-0x0000000000941000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avast.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avast.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a.exe -
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet avast.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier avast.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 avast.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 avast.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString avast.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 avast.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier avast.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier avast.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1528 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1528 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1892 a.exe 2652 avast.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1836 wrote to memory of 1892 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 30 PID 1836 wrote to memory of 1892 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 30 PID 1836 wrote to memory of 1892 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 30 PID 1836 wrote to memory of 1892 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 30 PID 1836 wrote to memory of 1892 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 30 PID 1836 wrote to memory of 1892 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 30 PID 1836 wrote to memory of 1892 1836 b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe 30 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 1892 wrote to memory of 2928 1892 a.exe 31 PID 2928 wrote to memory of 2652 2928 a.exe 33 PID 2928 wrote to memory of 2652 2928 a.exe 33 PID 2928 wrote to memory of 2652 2928 a.exe 33 PID 2928 wrote to memory of 2652 2928 a.exe 33 PID 2928 wrote to memory of 2652 2928 a.exe 33 PID 2928 wrote to memory of 2652 2928 a.exe 33 PID 2928 wrote to memory of 2652 2928 a.exe 33 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 2652 wrote to memory of 1984 2652 avast.exe 34 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35 PID 1984 wrote to memory of 1528 1984 avast.exe 35
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4f058ff3a9b018dff2d84422836e3f3_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\a.exe"C:\Users\Admin\AppData\Local\Temp\a.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\a.exe
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Roaming\avast.exe"C:\Users\Admin\AppData\Roaming\avast.exe" \melt "C:\Users\Admin\AppData\Local\Temp\a.exe"5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Roaming\avast.exe
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Roaming\avast.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1528
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
636KB
MD56eaf5e82d7c9a1bfaca0cd0763567419
SHA1e1014a11e31b770d633ee5afe6bdf2cdd19b4cda
SHA256c52947ccd078559ad020a960e8701d609fc24547965a03ae8e2272d547643254
SHA51201eb2fc379fac5d828a47f24e17de462226ff4ff6b198e603d41901495256d5780df1edf1776cf2b34ad57f26953222567d9ebbd19996d280519500d56bc1ad5