Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2025 22:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_7c7112065f4022dd47ef69e39ba2caf0.exe
Resource
win7-20240729-en
windows7-x64
8 signatures
150 seconds
General
-
Target
JaffaCakes118_7c7112065f4022dd47ef69e39ba2caf0.exe
-
Size
607KB
-
MD5
7c7112065f4022dd47ef69e39ba2caf0
-
SHA1
09cc3c987aade05e1004adea1af7c5b287951b37
-
SHA256
24a0d73a194b3ad3f22e4fb1de1d5f27597ab7dfc8e79089760739509a6c4513
-
SHA512
d4c5eaa061101c71486c736dd1f8d0960765b7e5a80242b932aa9ce2bed4c711ae2c68ab008e176f9ec580e26d0b767e10e1f9d2c666e2c97473baf7b933f1a0
-
SSDEEP
12288:JBwmc9bj45zYAekJWIHSEGYOhrOH2HyFWrkHzR9cQCIHFU8//OZH:0mcaJXeWWIHSlhjHycgHzRNHFB
Malware Config
Signatures
-
Expiro family
-
Expiro payload 1 IoCs
resource yara_rule behavioral2/memory/2228-2-0x0000000001000000-0x0000000001262000-memory.dmp family_expiro1 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7c7112065f4022dd47ef69e39ba2caf0.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "162" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 2072 Process not Found 4992 Process not Found 2768 Process not Found 4000 Process not Found 4936 Process not Found 3588 Process not Found 1604 Process not Found 4464 Process not Found 3708 Process not Found 4112 Process not Found 3200 Process not Found 8 Process not Found 2912 Process not Found 976 Process not Found 460 Process not Found 3596 Process not Found 1268 Process not Found 2112 Process not Found 2744 Process not Found 2044 Process not Found 4024 Process not Found 3268 Process not Found 4260 Process not Found 3464 Process not Found 1996 Process not Found 1388 Process not Found 5024 Process not Found 4716 Process not Found 4548 Process not Found 4968 Process not Found 4720 Process not Found 4132 Process not Found 4008 Process not Found 5036 Process not Found 4264 Process not Found 2604 Process not Found 5068 Process not Found 2812 Process not Found 1688 Process not Found 2224 Process not Found 3556 Process not Found 4104 Process not Found 4452 Process not Found 4248 Process not Found 1340 Process not Found 4312 Process not Found 1256 Process not Found 4996 Process not Found 4580 Process not Found 1412 Process not Found 1648 Process not Found 3420 Process not Found 2676 Process not Found 3696 Process not Found 1596 Process not Found 2448 Process not Found 1592 Process not Found 4852 Process not Found 1784 Process not Found 2616 Process not Found 5012 Process not Found 3920 Process not Found 3340 Process not Found 4776 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2732 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c7112065f4022dd47ef69e39ba2caf0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c7112065f4022dd47ef69e39ba2caf0.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2228
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa392a055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2732