24a9a74447fe8a817ac2e78dea079cb7e14479d2d785461aa4903fecaf71e12f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe
Size

899KB
MD5

e9f3d6099183d3bf18facd66c47bd1f2
SHA1

0734030651ae43ef437091178ff0d1b4e1d7114d
SHA256

24a9a74447fe8a817ac2e78dea079cb7e14479d2d785461aa4903fecaf71e12f
SHA512

d95418790a253918c0d3b573d3c9991b66b910f4afe3216a0bdc4a8302d21141bc97ee05145f2abebd2e8b69dee19c793d9b4cf0359faae91949dee31a9cea05
SSDEEP

24576:JxGaeDp3kdGp9kyPVzECqCYRK+ILTfBLXSYo:Cak9P7+CK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3032	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp

Loads dropped DLL 9 IoCs

pid	Process
2924	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe
3032	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
3032	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
3032	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
3032	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
3032	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
3032	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
3032	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
3032	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp

Modifies system certificate store 2 TTPs 4 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d461d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67080b00000001000000140000005500530045005200540072007500730074000000140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d8090000000100000016000000301406082b0601050507030306082b060105050703080f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3032	2924	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe	28
PID 2924 wrote to memory of 3032	2924	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe	28
PID 2924 wrote to memory of 3032	2924	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe	28
PID 2924 wrote to memory of 3032	2924	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe	28
PID 2924 wrote to memory of 3032	2924	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe	28
PID 2924 wrote to memory of 3032	2924	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe	28
PID 2924 wrote to memory of 3032	2924	e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\is-3SPJ6.tmp\e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3SPJ6.tmp\e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp" /SL5="$4014E,500148,146432,C:\Users\Admin\AppData\Local\Temp\e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f8c3db21b8b88a6aeb698be2fc88438

SHA1
843884dc77d2b46a0140442fc65fa486b3eb4568

SHA256
ee091d33a9b560adb58eed36306a246a2eb59a76f592aac4b8c38fcdd72dfa74

SHA512
6deb73e19158a659735c8fe1e423f20236dde7935aabfa4fda3df6786cde87c099759125639450b0bd4e22864e3d0b7c76cc081e71dec2c44a70f3b7876fe7c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AA9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\Temp\is-3SPJ6.tmp\e9f3d6099183d3bf18facd66c47bd1f2_JaffaCakes118.tmp

Filesize
1.1MB

MD5
53d53cb910b764c67c7bc5f46bfe38a2

SHA1
acb9ae29d4ab5857fe3c837bc8c571f0aadb3351

SHA256
f1c6a977297caf94eb3b07259116aa9412f5b2f11a48833104c5582f32f2b499

SHA512
dba598908f5123d2f45ef40c1619b827055bf4a49904024957008daeccd561b02d70fe95d8a3531e5dfbb290e7a9454d858c297d09fcbd48c151b11456099da9

Download Submit
\Users\Admin\AppData\Local\Temp\is-7BH34.tmp\InnoSetupHelper.dll

Filesize
82KB

MD5
bfff55aa09f4b60948c8633bf0b46a63

SHA1
ebec386517eb4cbb189bbdbfd6fc67c740417ff3

SHA256
1626d93dc77ab3ba4fc3c8ebabd7b552cb2f4249262959b005c2d083ca65ed65

SHA512
8b45a51a0ccb32198de297ceb09a53ac7f160a52bb5c3d105fdc43ce8de7e9c0c421f0fcbdba72ca201c166b2f89ddb7af9c7e81fa981388ba9883439d684b97

Download Submit
\Users\Admin\AppData\Local\Temp\is-7BH34.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-7BH34.tmp\innocallback.dll

Filesize
69KB

MD5
c161e8bee1e81d8d4f75ceb3a619f879

SHA1
5c1319bfe5529c93e371faa616dcbf32fc7b0aaa

SHA256
1ce3e9e0bdca3aef9b68a7672696c11ac493bd2153d013c92aa078006c8184de

SHA512
a6ac4418024b6e3bb2e490492ef9a2e0236a5a349cfcbb3256a646769dd9fdf144a2b1260cac42dda70c9cf98437dccb6ca0eb22548f2667ed6da906ecb861da

Download Submit
\Users\Admin\AppData\Local\Temp\is-7BH34.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
\Users\Admin\AppData\Local\Temp\is-7BH34.tmp\webbrowser.dll

Filesize
425KB

MD5
b576c4fdd6d0d3db25e2917ff3cd95a4

SHA1
3724f3708b4f8f76e9c8ff8c2f7bed70fc976d2d

SHA256
0ad1dc0094ad376eee23433b9416e8e1d7f6326a50c1f7bce5957f119ecc0e7e

SHA512
1a5e88a297b694dc7fe45756e5ef77abce5d1d45ef0a975f0278d8ce06cd32032ae34b62f436f83bc02463cab17802eca6bf1ab48930eceabdb3b72f45fbeefb

Download Submit
memory/2924-1-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2924-191-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2924-146-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3032-39-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-38-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-35-0x0000000005590000-0x00000000055D0000-memory.dmp

Filesize
256KB

Download
memory/3032-25-0x00000000052D0000-0x00000000052E5000-memory.dmp

Filesize
84KB

Download
memory/3032-145-0x0000000005590000-0x00000000055D0000-memory.dmp

Filesize
256KB

Download
memory/3032-21-0x0000000005260000-0x00000000052D0000-memory.dmp

Filesize
448KB

Download
memory/3032-147-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3032-148-0x0000000005260000-0x00000000052D0000-memory.dmp

Filesize
448KB

Download
memory/3032-149-0x00000000052D0000-0x00000000052E5000-memory.dmp

Filesize
84KB

Download
memory/3032-189-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3032-190-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/3032-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download