aa49cfd5573d9f0c9293907d412ad07d63bb1ba989f27667b01a6e498480b304

Analysis

max time kernel
148s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe
Size

551KB
MD5

f61d4662a415c9057b633e009eeedff8
SHA1

039999bc4d1951f5125e6e40c08edb8b203b78bd
SHA256

aa49cfd5573d9f0c9293907d412ad07d63bb1ba989f27667b01a6e498480b304
SHA512

9b3e9409317f61854ebf5791c80a396c5bd3a47af51dc0ac157079200f2bc8e4e1160d12e69bb31b47eecbfdade6822ae7f322318f86c783a72817a3cbce82ed
SSDEEP

12288:ts1Q0RGXqkAvRbQxARoOaqObVHQo30ve2vZd4:t0fPpJoOaHyRGsZK

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2704	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2560	Hacker.com.cn.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Hacker.com.cn.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DB14485-0BDA-4E05-ABC4-CA60423FADA5}\WpadDecisionTime = 003088cfdd90da01	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-70-d1-5d-21-ee	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DB14485-0BDA-4E05-ABC4-CA60423FADA5}\WpadDecisionReason = "1"	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DB14485-0BDA-4E05-ABC4-CA60423FADA5}\WpadDecision = "0"	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-70-d1-5d-21-ee\WpadDecisionTime = 20135301de90da01	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DB14485-0BDA-4E05-ABC4-CA60423FADA5}\WpadNetworkName = "Network 3"	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-70-d1-5d-21-ee\WpadDecisionReason = "1"	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-70-d1-5d-21-ee\WpadDecision = "0"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-70-d1-5d-21-ee\WpadDetectedUrl	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DB14485-0BDA-4E05-ABC4-CA60423FADA5}	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DB14485-0BDA-4E05-ABC4-CA60423FADA5}\8a-70-d1-5d-21-ee	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DB14485-0BDA-4E05-ABC4-CA60423FADA5}\WpadDecisionTime = 20135301de90da01	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-70-d1-5d-21-ee\WpadDecisionTime = 003088cfdd90da01	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Hacker.com.cn.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe
Token: SeDebugPrivilege	2560	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2560	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2520	2560	Hacker.com.cn.exe	29
PID 2560 wrote to memory of 2520	2560	Hacker.com.cn.exe	29
PID 2560 wrote to memory of 2520	2560	Hacker.com.cn.exe	29
PID 2560 wrote to memory of 2520	2560	Hacker.com.cn.exe	29
PID 2224 wrote to memory of 2704	2224	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe	30
PID 2224 wrote to memory of 2704	2224	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe	30
PID 2224 wrote to memory of 2704	2224	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe	30
PID 2224 wrote to memory of 2704	2224	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe	30
PID 2224 wrote to memory of 2704	2224	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe	30
PID 2224 wrote to memory of 2704	2224	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe	30
PID 2224 wrote to memory of 2704	2224	f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f61d4662a415c9057b633e009eeedff8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:2704

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Hacker.com.cn.exe

Filesize
551KB

MD5
f61d4662a415c9057b633e009eeedff8

SHA1
039999bc4d1951f5125e6e40c08edb8b203b78bd

SHA256
aa49cfd5573d9f0c9293907d412ad07d63bb1ba989f27667b01a6e498480b304

SHA512
9b3e9409317f61854ebf5791c80a396c5bd3a47af51dc0ac157079200f2bc8e4e1160d12e69bb31b47eecbfdade6822ae7f322318f86c783a72817a3cbce82ed

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
dbf6a68e8f91531f359981c182e27ac3

SHA1
a3b8c16e061599e33428239e6ba69eb5ff82ba1d

SHA256
bdea8526c4e1aedcdc80b9795002167610784445b6e249fe32c410cda33900e2

SHA512
39b7cd587165ef9a9821eefcb1dc71d934174e7b899d17d1a5f248abfabf21e18a22c054e5b6dd58004c03122d4d3ac45905b530b78076921d0c110e2e687068

Download Submit
memory/2224-15-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/2224-4-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/2224-2-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/2224-6-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/2224-5-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2224-8-0x0000000001E80000-0x0000000001E81000-memory.dmp

Filesize
4KB

Download
memory/2224-7-0x00000000027F0000-0x00000000027F3000-memory.dmp

Filesize
12KB

Download
memory/2224-9-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/2224-11-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2224-10-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2224-13-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/2224-12-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/2224-14-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/2224-16-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download
memory/2224-0-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/2224-3-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2224-36-0x0000000001CC0000-0x0000000001D0B000-memory.dmp

Filesize
300KB

Download
memory/2224-35-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/2224-1-0x0000000001CC0000-0x0000000001D0B000-memory.dmp

Filesize
300KB

Download
memory/2560-22-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/2560-24-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/2560-25-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/2560-26-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2560-23-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/2560-21-0x0000000000340000-0x000000000038B000-memory.dmp

Filesize
300KB

Download
memory/2560-20-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/2560-38-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/2560-39-0x0000000000340000-0x000000000038B000-memory.dmp

Filesize
300KB

Download
memory/2560-41-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2560-44-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download