Analysis
-
max time kernel
90s -
max time network
87s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 11:31
Static task
static1
Behavioral task
behavioral1
Sample
1b20af19468f2385be2da8436febb0ac_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
1b20af19468f2385be2da8436febb0ac_JaffaCakes118.dll
-
Size
156KB
-
MD5
1b20af19468f2385be2da8436febb0ac
-
SHA1
496ea51803ff20573208403f8cedaa28831d1fc1
-
SHA256
5724dff81bdade2b6fe5e858b73421f8f1b1d9aca48dfffce8f5cc18cfcfb8b5
-
SHA512
2c612cb9ebfdc59c76c228f29d2af703a4edb0e5e5337cec23ce19b21af117d449f18f172da02b0a3b68a905086f7c7b7bfeee1f811484b19af575f1d17736e1
-
SSDEEP
3072:lGttwyTViRa7B7xtAYC5jwZgFRnnMbabYwN4jYvhY6:lGXwyRN71xmnhwybnMs
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
qRP9q23description ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation qRP9q23 -
Executes dropped EXE 2 IoCs
Processes:
qRP9q23ppixxjohehwkdkuc.exepid process 1224 qRP9q23 3124 ppixxjohehwkdkuc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2576 4848 WerFault.exe svchost.exe 3764 2372 WerFault.exe rundll32.exe 4668 3460 WerFault.exe svchost.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{865829AE-379D-11EF-BCA5-6E6D447F5FDC} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425995384" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 656 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
qRP9q23ppixxjohehwkdkuc.exedescription pid process Token: SeSecurityPrivilege 1224 qRP9q23 Token: SeDebugPrivilege 1224 qRP9q23 Token: SeSecurityPrivilege 3124 ppixxjohehwkdkuc.exe Token: SeLoadDriverPrivilege 3124 ppixxjohehwkdkuc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
IEXPLORE.EXEpid process 3324 IEXPLORE.EXE 3324 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 3324 IEXPLORE.EXE 3324 IEXPLORE.EXE 5056 IEXPLORE.EXE 5056 IEXPLORE.EXE 5056 IEXPLORE.EXE 5056 IEXPLORE.EXE 3324 IEXPLORE.EXE 3324 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeqRP9q23iexplore.exeIEXPLORE.EXEiexplore.exedescription pid process target process PID 792 wrote to memory of 2372 792 rundll32.exe rundll32.exe PID 792 wrote to memory of 2372 792 rundll32.exe rundll32.exe PID 792 wrote to memory of 2372 792 rundll32.exe rundll32.exe PID 2372 wrote to memory of 1224 2372 rundll32.exe qRP9q23 PID 2372 wrote to memory of 1224 2372 rundll32.exe qRP9q23 PID 2372 wrote to memory of 1224 2372 rundll32.exe qRP9q23 PID 1224 wrote to memory of 4848 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 4848 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 4848 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 4848 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 4848 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 4848 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 4848 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 4848 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 4848 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 1524 1224 qRP9q23 iexplore.exe PID 1224 wrote to memory of 1524 1224 qRP9q23 iexplore.exe PID 1224 wrote to memory of 1524 1224 qRP9q23 iexplore.exe PID 1524 wrote to memory of 3324 1524 iexplore.exe IEXPLORE.EXE PID 1524 wrote to memory of 3324 1524 iexplore.exe IEXPLORE.EXE PID 3324 wrote to memory of 5056 3324 IEXPLORE.EXE IEXPLORE.EXE PID 3324 wrote to memory of 5056 3324 IEXPLORE.EXE IEXPLORE.EXE PID 3324 wrote to memory of 5056 3324 IEXPLORE.EXE IEXPLORE.EXE PID 1224 wrote to memory of 3460 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 3460 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 3460 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 3460 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 3460 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 3460 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 3460 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 3460 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 3460 1224 qRP9q23 svchost.exe PID 1224 wrote to memory of 996 1224 qRP9q23 iexplore.exe PID 1224 wrote to memory of 996 1224 qRP9q23 iexplore.exe PID 1224 wrote to memory of 996 1224 qRP9q23 iexplore.exe PID 996 wrote to memory of 812 996 iexplore.exe IEXPLORE.EXE PID 996 wrote to memory of 812 996 iexplore.exe IEXPLORE.EXE PID 3324 wrote to memory of 2028 3324 IEXPLORE.EXE IEXPLORE.EXE PID 3324 wrote to memory of 2028 3324 IEXPLORE.EXE IEXPLORE.EXE PID 3324 wrote to memory of 2028 3324 IEXPLORE.EXE IEXPLORE.EXE PID 1224 wrote to memory of 3124 1224 qRP9q23 ppixxjohehwkdkuc.exe PID 1224 wrote to memory of 3124 1224 qRP9q23 ppixxjohehwkdkuc.exe PID 1224 wrote to memory of 3124 1224 qRP9q23 ppixxjohehwkdkuc.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b20af19468f2385be2da8436febb0ac_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b20af19468f2385be2da8436febb0ac_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qRP9q23"qRP9q23"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 2045⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3324 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3324 CREDAT:17416 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 2045⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\ppixxjohehwkdkuc.exe"C:\Users\Admin\AppData\Local\Temp\ppixxjohehwkdkuc.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 6363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3460 -ip 34601⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qRP9q23Filesize
95KB
MD57fc51f7f09344a3dbeb28e14c35ce39d
SHA1c8a9082351f5edcd3012d5379caa33e0804e954f
SHA25691eceecf4fdcaff36652a1a3a5d25ee37fff70796e71438c60446a2ea72c0a78
SHA512b40a5743a212038161065af0dbfd0aa7b386b9bd8ae080e621459465e6f6dd888cb9ee35b4f152e5f6931446ad3f1696f6b98b9494903d02ab86493939cae508
-
memory/1224-25-0x00000000775A2000-0x00000000775A3000-memory.dmpFilesize
4KB
-
memory/1224-10-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/1224-17-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/1224-22-0x00000000775A2000-0x00000000775A3000-memory.dmpFilesize
4KB
-
memory/1224-21-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/1224-9-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/1224-12-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/1224-34-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/1224-24-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/1224-6-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/1224-7-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/1224-5-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/2372-15-0x0000000074FE0000-0x000000007500A000-memory.dmpFilesize
168KB
-
memory/2372-0-0x0000000074FE0000-0x000000007500A000-memory.dmpFilesize
168KB
-
memory/3124-42-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/3124-41-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/3124-37-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/3124-36-0x0000000000400000-0x000000000043A04C-memory.dmpFilesize
232KB
-
memory/3124-35-0x0000000000590000-0x0000000000592000-memory.dmpFilesize
8KB
-
memory/4848-13-0x0000000000FE0000-0x0000000000FE1000-memory.dmpFilesize
4KB
-
memory/4848-14-0x0000000000FC0000-0x0000000000FC1000-memory.dmpFilesize
4KB