ad10606f3fb69f8908b950eb0b85100d73f3e9336a0c5cbdb64665551ceceaa9

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe
Size

696KB
MD5

edf693864be0bedab974fefb090d9a20
SHA1

a6ca9c6b91439c243c08d8f8e1acf35f5640a88a
SHA256

ad10606f3fb69f8908b950eb0b85100d73f3e9336a0c5cbdb64665551ceceaa9
SHA512

ab12b72a9756a1c0d3c806b15e70518d9df421fa64df4d887e2f9bb088a7de289fa5290bf6d95333e9b89ec29982beba04cc7cbf3aa37135d1e60e90ee074cb0
SSDEEP

12288:Rol66wfKPfhcwU/jw1+0GX3z4dFeLiXS+rCsdq9+uJ7zk+nG8R5+YIHf8pw5a4EL:GlGyXCwE4+1XDDDvsdq3JhG8RobEpcaH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1724	CheckVer104.exe
1296	regver.exe

Loads dropped DLL 9 IoCs

pid	Process
2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe
2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe
2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe
2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe
1296	regver.exe
1296	regver.exe
1724	CheckVer104.exe
1724	CheckVer104.exe
1724	CheckVer104.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	regver.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	CheckVer104.exe
1296	regver.exe
1724	CheckVer104.exe
1296	regver.exe
1296	regver.exe
1296	regver.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1724	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	28
PID 2032 wrote to memory of 1724	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	28
PID 2032 wrote to memory of 1724	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	28
PID 2032 wrote to memory of 1724	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	28
PID 2032 wrote to memory of 1724	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	28
PID 2032 wrote to memory of 1724	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	28
PID 2032 wrote to memory of 1724	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	28
PID 2032 wrote to memory of 1296	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	29
PID 2032 wrote to memory of 1296	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	29
PID 2032 wrote to memory of 1296	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	29
PID 2032 wrote to memory of 1296	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	29
PID 2032 wrote to memory of 1296	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	29
PID 2032 wrote to memory of 1296	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	29
PID 2032 wrote to memory of 1296	2032	edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edf693864be0bedab974fefb090d9a20_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\TempImg\CheckVer104.exe
  C:\Users\Admin\AppData\Local\TempImg\CheckVer104.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1724
- C:\Users\Admin\AppData\Local\TempImg\regver.exe
  C:\Users\Admin\AppData\Local\TempImg\regver.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ce5d011ba10ca849f63314b4460b6a4

SHA1
cf32df357167d1fa843908344a5515bb94b7961a

SHA256
6341ccad8de205a14b5648f3181a685a122cad33f2c9a1848a3139941c277cb2

SHA512
3802e1d0279e8132f1374736fe7fe769f546dddc4db4d408786de1d79d52999a3e31f5576f96c85f4b8e50885b3752ba20fd41581def6f904af16a6080148575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0e29c7241034768779f7783600728c5

SHA1
36a06304ef846dc13a90f6ea07ac18bf600b833a

SHA256
8b7608c00e8361d35fe7789ed45ff835e277a3397937ad2a5c9a4acc87d4bc9b

SHA512
2a1f956b368a122121fae581fd2a14f41555b09c4f94ee58b3bc235d77a6e635670b7820a1f1057d88244d0a5a0807a43559d689f158129ff103c2d3aecc542c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07ac4b8459f98c43faf2f9802d9aecf7

SHA1
33da0f6cad47c8ab471022c926f8354c09e126a7

SHA256
7128ca2a94b0db6d8c37658d180eef31bf1b2ca83b815b95d5bb288044596c2d

SHA512
0bc7261c9bf6d8ac2c47c448b27923debc771724a9d9e9d10a163b59ec4eda7059ed49c06d4c1624fb9f4b7fcf404a821156fdbc53fc5710d1111b749c69bb87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27ab3a044f74702a17a16992c637205b

SHA1
529dbf70ed7c5b83521c2484040b96fb3a3575ff

SHA256
10fc3cb122fdcdd1d3356702e8ce072c1035acdc4c612393ad1f9036c73f7ef8

SHA512
c4b66e7eebdcdd68e22c5f18ee94727d3749dcd10525bead73bc6f611f784b24ea8c777ed93dd06e334716a220da9305ea3ac4183c4d53f579287d55288d8cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
389e07c6dcf29cbd8635204c39341eb0

SHA1
736cb3c05c0494d83cb6c5c6c2301ba212a12653

SHA256
4a3672f8349dff0ad9f236ddbc9cdd1a342b0556805055521594d1316a30aa7b

SHA512
8839fa0eee776bd3d3430ae88a828e56782c50a32b3ffcc98872be8d3be4006fc988fc8b31929811cdd19b810535b3b618286335c0f9372899a69792cb270f42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f05a81ff14c0e5e8d145ed83b38abb4c

SHA1
a3ed91ae76689575e2ce4502d2867d0b837e0a44

SHA256
9845d20b0a3db64c240ad263174bd51d31a3fe17680849711af832522a3bdd65

SHA512
bc6a23f038a2d0e810fa6b5c5722641ff03749b61866f5638a8eff0f63f58a4069da6d756d000aad33f78305bcb5df9963ec8d97c247e96aa646b4e1fbf15672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66e7166a5fb91eb5ae50be5e1edcc06c

SHA1
42a3829672907ff568ca0db6931abbfd65d823e6

SHA256
2ca5fc7de0ea48b8001067a64458f5df915be748ae7ae93a8e35de63d9d43781

SHA512
f5de9819888a8dd155772a0e93db48cb3021e2d126599bff9cb488aad833c8894b5c569655020245a317ec0d4fd83626900de4f13c5e355d6728e68443374ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5703c02bd113cb21b65174226d0f9980

SHA1
8cb6c70c5d97a8827dfdbee1617db01aaea987c3

SHA256
6fad0e1ffab621d6c71326230df187cfb9e3565a6a7a91f54e8886c9ead1355f

SHA512
be1eb368039e157f4f5743f33bfdb559dfc2450054023847cd1c89cc99fff25772b8b3a6e4f0b0944efaf316aa2af779b801b5859bda0409d4ac71d02d686e08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ba18b4b976ad20cf9e46fc1eb8d10ed

SHA1
4b43d19e84e3b9658d5b163af870d4a090eb2761

SHA256
cd2adfd840995bcfa7ba8a74c31090b94450f370db9af72f1b67ea1e9b8b168a

SHA512
2daba049cb889e4bfebbae4d211fccf5365adc47c16567d40ac806eb79286cf9c97511582a13d41b79bf3bbf7305ac5c2bcd13f19246c4264a9198e19238f09f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93d08c6b882c2030389264cea143078b

SHA1
b7385b162d60f106c8d58de4bd8215ebfaa5d117

SHA256
e7d498f8d6b36ab39493d941407b9053e89564b2eedf82bb5d1125aa3a9e516b

SHA512
9e6dabb3efeb434d8739eb1dda4c800f221d8ce0bd6d7aa6bcc276f035f48b29106bcf14cd736a2def8b7f4f549764216ab50210cc7c37ed1d08c4de14a9a7a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db819531d4cd37c0b7f53ce2632357dd

SHA1
39006cb90c66ae590de452ed8324cd16c7e598d8

SHA256
f927ec5f5ce97e89fc39c6fd2d0f9b9cef69f9d44f634df5278b1f043dcf0951

SHA512
dc8bb79b706b90fd75472780812fe3fe58064bd4c5d9abc8031966e734a12ecc04979e4bc93136460588ece05df2f4e180b36dbd5c65360ab55c825f060ca91f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
0cec7bfe5eba2bb1e744485324e4e1ec

SHA1
6065df7c130b3c6bc021bc7b4d1e447261980af9

SHA256
00dfb87ae30799fc24e0d63b083e5c8d16b8b2309752241340f851229292dba9

SHA512
964dc2f98991a4574c2e5335b31ad644ee1267587b6a19d825ee1582f4aa7064d5e408a6b85f57dacab9177a0937a2a4600a6e1b1a191497e2b25b3d8f32304d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8651.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8674.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8800.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\TempImg\CheckVer104.exe

Filesize
332KB

MD5
fa199dffc4991a36725e1a2d272e787e

SHA1
68c1db76a8080782e3f450e3f724e4e1564b18f6

SHA256
13c8453cb118d3f9d2dc2a1189633ab10162f902758320487f03daf124c4bb9e

SHA512
8dc6a2369dc87148ac45cd6ae37f33fcb32c4fd863d17f6166a41c7a4ef40edd6a4da0f57536f382e550add791bf678a5116e0f1cb440649be1b924c3a31a520

Download Submit
\Users\Admin\AppData\Local\TempImg\regver.exe

Filesize
290KB

MD5
9181b183dd3096301e7211ed0312de8a

SHA1
0c321747b581ad79da70dc9aab183cc12c3bbefd

SHA256
202fcecc53f1ffd2d1d85cc4cc79a24ae37285ce564e15615b5d13ca69487968

SHA512
5316e0511746c75603ba02eaf79b9aafbb29356f94279f466d3f17e9894082f14cf052ca3b8f52a149815e8c9b58f5d4b02ef1dcc3d677dc27032480f788adf7

Download Submit
\Users\Admin\AppData\Local\Temp\nso79C3.tmp\ExecDos.dll

Filesize
5KB

MD5
a7cd6206240484c8436c66afb12bdfbf

SHA1
0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919

SHA256
69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926

SHA512
b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904

Download Submit
\Users\Admin\AppData\Local\Temp\nso79C3.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit