Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 12:23
Static task
static1
Behavioral task
behavioral1
Sample
1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe
-
Size
980KB
-
MD5
1b4a34e0d73123d8678b8e9dcf71e75b
-
SHA1
435e4b4ed57da91c57526f675da684fb1f4f27cf
-
SHA256
2793769b0b5b8154971ffcdf6758ea9def6dfd75e3ebbfb1c3bf81aafeea401a
-
SHA512
0b12049a9de7997b98c448b4bb05d2962dcfed5846856b5b6aa52b915ec4b58af46aafc481f88b62b7c961d2e44385f72334e3b6a6856b499453797594c76e00
-
SSDEEP
12288:nj84YFQ/IeTLHQBLfgmFgvMbF4rYrPUXMWmf7O4FwlTcpreytAG9wrqCH5yCv1:nVAHr4/mzO4Fw1wAG925yk1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe -
Processes:
resource yara_rule C:\Windows\rxing.bat vmprotect -
Drops file in Windows directory 3 IoCs
Processes:
1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exedescription ioc process File created C:\Windows\mssoft.bat 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe File created C:\Windows\JoachimPeiper.dat 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe File created C:\Windows\rxing.bat 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 456 taskkill.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116209" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426601661" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3147660416" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804c30bdb1cbda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 700735bdb1cbda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116209" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000097a1eb2157cf4047a4f2ea4b9291f32300000000020000000000106600000001000020000000287c31dffe834a775a781315e76b2d31879dac0986d682ec719ceabd71b43dea000000000e8000000002000020000000cdbc83d602969d4a1ef7123245aba09245bb1dfa92db2be3c963dec6cccc3ec0200000001d23c1bea2bcdd2fd7363c0623fd09a27d3097ce1c6c36a0269e506d8948446a40000000a54ade0e945b8f7e99c400d7f19ff224cc237b64c56e91fa76098db17cdc65276966a2df0482e027b2ee229fff99621bfacf0e6b8db779f4023bdf6bc3e018ec iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E7250195-37A4-11EF-86EC-76D7D0441B5E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3148441679" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116209" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3148441679" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000097a1eb2157cf4047a4f2ea4b9291f3230000000002000000000010660000000100002000000062fb083eb9caf1d3d7f2e34c5f5f08b21f7c98e20fde97d07e53ea8e5c6aac81000000000e800000000200002000000068ec32403831e7a31a642dce626f7396a872c32d7ad18f78168305cc332a9bad20000000de4dd0358519e05cfa058a8278f241f0d1eaf3c94bd2a4f4fe81ef3978ae03b640000000dae68268d0d76bfda69a834faef0ebf02287f99f51a75cf308c505f3919df80849d8d1dd6aaf3514f6fc4aaabc84c871ed69c4d930317931b3bb25d13ba50408 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116209" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3147660416" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exepid process 4220 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 456 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4376 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4376 iexplore.exe 4376 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exeexplorer.execmd.exeiexplore.exedescription pid process target process PID 4220 wrote to memory of 2304 4220 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe explorer.exe PID 4220 wrote to memory of 2304 4220 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe explorer.exe PID 4220 wrote to memory of 2304 4220 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe explorer.exe PID 4808 wrote to memory of 4580 4808 explorer.exe cmd.exe PID 4808 wrote to memory of 4580 4808 explorer.exe cmd.exe PID 4220 wrote to memory of 4376 4220 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe iexplore.exe PID 4220 wrote to memory of 4376 4220 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe iexplore.exe PID 4220 wrote to memory of 4760 4220 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe cmd.exe PID 4220 wrote to memory of 4760 4220 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe cmd.exe PID 4220 wrote to memory of 4760 4220 1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe cmd.exe PID 4760 wrote to memory of 456 4760 cmd.exe taskkill.exe PID 4760 wrote to memory of 456 4760 cmd.exe taskkill.exe PID 4760 wrote to memory of 456 4760 cmd.exe taskkill.exe PID 4376 wrote to memory of 3016 4376 iexplore.exe IEXPLORE.EXE PID 4376 wrote to memory of 3016 4376 iexplore.exe IEXPLORE.EXE PID 4376 wrote to memory of 3016 4376 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b4a34e0d73123d8678b8e9dcf71e75b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\nod816.bat2⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.google.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4376 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\mssoft.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im qq.exe /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\nod816.bat" "2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5df3b51cc5929f3af03350336b1afc568
SHA148453c44facbbea059f9da8565cf25b1c2cb9ce0
SHA2562375353160c5f8c4cadce5954ff4a7cc5b9c403890f0404791ff85c8ec0dd748
SHA512d8eaa0761def6d74462748aa794198b5f32fa593662bf373c81e1d300f3f76ecc1c723cef52774caa6482527f26524fd2677a5e2253285cb6d0984b044347e8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5d88882c2c4e8d4328ca1c22129dd11a6
SHA177410a39e16927c86e8649587eda322d0562b36d
SHA256859f5d9deb56f81892956821debcd76cdbb885ef20580a97bea6ec6d0af37e79
SHA5121920ee5e52a2a28abf38dfa7f7f77b1bd70beb3ff85e0b34cf35f6d2beee90311663d6da7141931fca2574a2fc0a173d40cc01427e0cf818fa97d7428ce4e4fb
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC1F8.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2f2u7jc\imagestore.datFilesize
5KB
MD5b94a4f2601938bcaf22d965db4119e89
SHA11ea47d5ddce126c817b572d065a286fc7370ac44
SHA256d0fc76576ef8ecdd4d2eed78a5910ef1d46830aab8c1107559bcfc9d3606b356
SHA5127c86c2975b1112250b6bfe736d0c92ac866acd50e0d9f7f0bb29783d3eef7ae6b2e55c748bf1505ca1872ffcbe67779d9787d3b20c335839e307fae2be581f91
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\favicon[1].icoFilesize
5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Windows\mssoft.batFilesize
25B
MD53d7c7b33e3c17d8a0ff01e4647ba538b
SHA11c6f75ddb631093d3f6563d00eb0e0b959779e38
SHA256f2b5fcb625c6d60c62be2d371d45910506c4a650e6e1a994d0f284740d764c8e
SHA5129ac3b3359c342f8d1d5c7b31abbe5a3797b1d642e907d3c1e8706dc632ac1d9215c4eeaeed454e552217a44cac6e71a3c6bbdb670f0df5450922777bf3b84a15
-
C:\Windows\rxing.batFilesize
18.2MB
MD5de9b364971e516df97025c91f56a52b7
SHA1f2d0b2dc72cebc45855ba1ef830bdeda81bccf31
SHA25655cd4824054e26f311118fc1630be26f33c1d8fda552fbe5146c9ca7dbad503f
SHA5129777a6ce9bf44fd5d426acc1ddc73910908b9fef1ed942c72e7a4c77fa689f3f91c053cd61690e75b8ae59948ff36e937e5b4cbcd197dff574d32e4d11bc6e1d
-
C:\nod816.batFilesize
374B
MD5c9c561c8d6c771461a8ffa1adfab82a1
SHA1ab0d4ecd4e6750cd9c88d007dd39fa8e9abfff0d
SHA256fc5f49def9045d1f16ed8b63ee17dc9ecb8813348070a5c34d4ae073184dd077
SHA5121591a86ecb930b594b2b0be8ef8675dfad7b3b73fef28ebe95e9dfacb8fa4e743f1d3052b01d6bc009a86d12505be6098c698bee2ae52c911c6421c8e4137712