c789f3686074617e1c909dfa6f93f472e494833c254a2eadb5ba948096412ce7

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Size

28.8MB
MD5

2f82a626e189e3ee203c23954586cba9
SHA1

e8e42be1a2d64cfc02f1890547c0ca1595c59764
SHA256

c789f3686074617e1c909dfa6f93f472e494833c254a2eadb5ba948096412ce7
SHA512

3ec51ff75869c772431499d989ff7dd34cc70b9d1f56e41f5ca2d8be33ab0a2e5d3a536cb78e59f272977084a2a3a4f411a8b4bf0c2fd59c05d010b681748eb8
SSDEEP

786432:0gzzJZO1TCJVJwpHPeYJzYcUdMKgIr7ldmCExS5vzE:PpZETCpKHmYVGdMKgIrholU5vg

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
452	kupdata.exe

Loads dropped DLL 17 IoCs

pid	Process
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
452	kupdata.exe
452	kupdata.exe
452	kupdata.exe
452	kupdata.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir Desktop	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Premium Security Suite	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir PersonalEdition Classic	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir PersonalEdition Premium	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\CurrentVersion\Info	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\nsklog\kingsoftinst.txt	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\nsklog	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40381D51-F162-41a9-BE67-0851A3B02091}\KisPath	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40381D51-F162-41a9-BE67-0851A3B02091}\Pause = "1"	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40381D51-F162-41a9-BE67-0851A3B02091}\Pause = "0"	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{40381D51-F162-41a9-BE67-0851A3B02091}	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40381D51-F162-41a9-BE67-0851A3B02091}\state = "3"	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40381D51-F162-41a9-BE67-0851A3B02091}\KisErrors = "3"	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
Token: SeDebugPrivilege	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 452	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe	29
PID 1704 wrote to memory of 452	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe	29
PID 1704 wrote to memory of 452	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe	29
PID 1704 wrote to memory of 452	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe	29
PID 1704 wrote to memory of 452	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe	29
PID 1704 wrote to memory of 452	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe	29
PID 1704 wrote to memory of 452	1704	2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f82a626e189e3ee203c23954586cba9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\nsy2686.tmp\kupdata.exe
  -send 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\nsklog\kingsoftinst.txt

Filesize
849B

MD5
a601e428034df341d92e17f4a97ab365

SHA1
263a0cbcd0f2bc1a25ef5abef33f6280df28078d

SHA256
735f0aaae840738f697e6c7fd9c613edcbd976a0f51a2f2cfadd5e8bb164c820

SHA512
d2740e313e9f46e29ce6668577029cf59addc84a85307955e2dbaf1f4bb3db0df382205202a07e21c0bff708c155c8cb00ee95c21b77575e30c50ee2aa562e7e

Download Submit
C:\ProgramData\Kingsoft\KIS\User.DAT

Filesize
60B

MD5
965d870d1b35c3648cb243592e8e3f8b

SHA1
050e5f47495e99bef2a98becb3e8dbcb1c1dbc0d

SHA256
e05df189513037006137c62a50e9a8d66b1689ced723b31b3f96cb07fbc3d0e5

SHA512
bceb9f3d12771eae98b21d00eb7040d460d0719c84bb595a92c7e54ce27d9e8d70f77eade242969ff7f0b4d122ae6e787599c815f114c13018fa09d029803340

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy2686.tmp\clearlist.xml

Filesize
13KB

MD5
daa061911d43376beb0e07d9fe8ff479

SHA1
572764a406b4c720e0dec25ea65b0ff29407eb2e

SHA256
30565af84172cf3d288c541a0cbbcbe60afc10322fb21cdd1fa8b0b5a2be82b3

SHA512
79e276644f9d69fe5dcf4260df9e24b5ef067e2940ce1831fad03bf0d9f0cd0ccbb5ea6e1e90ac2397f5fa1368fdf1dd0da52c5b38952b6d2bdc4ee82c7509ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy2686.tmp\iowelcome.ini

Filesize
812B

MD5
b7ddcb92cd0f8657d0a0354c5da22dd2

SHA1
dbd663c0468453fd2fec361fb5ceead102003472

SHA256
0c2e3429d42326b4c2a155dafaf0330610d843d2d440f88584048bcc6f673062

SHA512
6ed51c2f144031756aa587f0032b45d168e8a5e937a3d2f4c5930c6b898a48776865c72fcd7c4759a9b95f7ee2434c9f35149dfe24768b99383840c291d9b96b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy2686.tmp\iowelcome.ini

Filesize
825B

MD5
cb245a48f1d777276766bd08ad9bb73d

SHA1
2348744d98210ca86c4b2023e067be8c622ad4a6

SHA256
e4b94484cea1b3c8d38b78f04bc962bed7c1fd6ed84f6710b17f9d69b85f4d77

SHA512
4b8e1a274e00c83b9fe5134e0d17a7583891f185326d9e9380e8a7bbbddbc07cf54af5cce95ec5e1e3d6367d171238dcc95bec2af6239adcbd49fd71215721a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy2686.tmp\kinfoc.dat

Filesize
2KB

MD5
2e2d040562e8089c2e2db0c217c48be3

SHA1
668ef4c4ea4e67144c1b546a5c9dfc18eaf009a3

SHA256
8ff27bd1428088ba0ca87be4a4a98b9adb311132efeadb173e8188159a80e406

SHA512
d32e0160f639162b2858b48dd4eaa7471ba48f084cf840743f72785c1b7bc9fb7bde5bd2322b83827b8b6eecfac7a9bf126720f02e35c29d76e29ae65e2f0e04

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy2686.tmp\log\setuphelper.log

Filesize
1KB

MD5
42de90dd1428e36bbf6890fe592f5444

SHA1
e9053cac8bb4004258f63925da1a4f68858fc7fc

SHA256
d9536fedc5b1cffc6d72b968f5daff910c8412283d0bc9903ce977efd0b938b1

SHA512
1ba527b4d6e615924ecdfd327f16aab41424430d19c61d73f90eb40e130a2f3da0749eaa71c38a68df926078be9debbe7b4ca69ac1a1d581a451c8cddf7cde75

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy2686.tmp\log\setuphelper.log

Filesize
4KB

MD5
8af304cc30db21eb9022ac4cb19a6e17

SHA1
04e840290df56edc202f244a7d0269fb86d0192a

SHA256
4a1924831c5bca4bbeda3e9039be65bd3da958e3aa80438c2b7de3d40793ba0c

SHA512
c88030408438fe8ea6666ac2cefaba379f24dc7145caf11ca93353e56b80163c0bad68f3e8dddf6f8a5e253f118612aae6d0a8cda94627dcffa951914a9313b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp428F.tmp

Filesize
46KB

MD5
71e75d6ac753c2a79bcb208692b6e767

SHA1
cb603d678cfc833f7d6f250c5085798e79f671f4

SHA256
8f44d90932504d979808ad9322ae22fcc5e72e898a2f864bfcdfd5d5c6082290

SHA512
7dac896f817d9e5056f1cb629c3ae9c19b75a12f6d9856a4593e1bbcad9b96116efbf3ac4f85f98d84d34df60c0054fee5f93c446ded348d87c5bbd14dac9bbb

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2686.tmp\InstallOptionsEx.dll

Filesize
109KB

MD5
d61e2f21de83247c39675feb9cdc5720

SHA1
d63905ab25a9509b4fe75b4df84cc2b09d5ae50d

SHA256
74db23fb889cafe045e39322884aeaf2e3f3e46d43c77d6907b8671abc23784f

SHA512
babd751f17f75187f66c85e4e4febb311a6ebc1e721cbd12b946b9887a907296e9f087c7ceae55628f9e6817697c3ef8858ec01f22a23abf3b3b1f26755fd294

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2686.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2686.tmp\UserInfo.dll

Filesize
4KB

MD5
1e8e11f465afdabe97f529705786b368

SHA1
ea42bed65df6618c5f5648567d81f3935e70a2a0

SHA256
7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b

SHA512
16566a8c1738e26962139aae893629098dc759e4ac87df3e8eb9819df4e0e422421836bb1e4240377e00fb2f4408ce40f40eee413d0f6dd2f3a4e27a52d49a0b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2686.tmp\kasearch.dll

Filesize
273KB

MD5
fa72134efe05fc7a2689e249f74c3f65

SHA1
f10c843b6cca133b7d7272ef8939a296c2b5162a

SHA256
e2ea47e381ceae1e9dfcbaef0c069c3eb66e6798efed79a98d117ea61043b2c6

SHA512
064b8e4cc09be97e0eed3444ef260c81cecd3c5a2aec8901247c4659326004444aeee347f7c5805417c6372fffcbf29a0d5fbe34de488e35e500bf53ac2e7cf2

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2686.tmp\kinfoc.dll

Filesize
557KB

MD5
e426dcc7d31263a8dc8ea653859206b7

SHA1
569c1cb69b1191c5473a9a64b78c8789e342f32c

SHA256
2c2297eb1654398e0cb57a7b4e6e66c7b41cefa1d85a3c9343c833314ab3ca49

SHA512
7101cba19635d7b7fe024d3e259cfbf01bc73c85eef8762b07ba4d14ced53d2504f6143b941f248532b102d521ce638cb8a21356bd459ea5de006f4ee9651367

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2686.tmp\ksiext.dll

Filesize
1009KB

MD5
335327c9d1e299ade4b7362ef60749d8

SHA1
83d4c646292e4194f0264f8427f61a7a7dfc3d9c

SHA256
7e6d2edb22bd9e7e4e826e3a6cbf7379285cdcc46045c8e4375b469b8f677a47

SHA512
f4e8dc14f39fd32420b389a1dddb7344507d16b82d5e15ffc85edff6ccac088a68a05ac60858a5f7b6aa7b32b1c33b211523d0936dc133228a7833ced921e83e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2686.tmp\kupdata.exe

Filesize
97KB

MD5
3a4301c60bd5666531f4243de6257289

SHA1
899a1b4f752162f71bbe12a30ec018a0d8785aa0

SHA256
7b82ec0e025fc2ae5d52a753daf354dc575149bb8884d905e868865eb52bda4f

SHA512
92ec498d5dc1188cebf38f9bcbc1e9d97993b12b967b41a0ff863385944110293068e66746bd4af910490c50c02e851b122ed63aa432a22717a55c85a9f6d8fd

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2686.tmp\setuphelper.dll

Filesize
425KB

MD5
31cbf1d1fe67d0f2fb06a76c537d9895

SHA1
4ca1882d38ec6ee6008b696366b4c9bb244e28e0

SHA256
7e5ee55ee9c2e482a8d8dadb00665ca2f93db74e95fe40c294f8518247a5f5f5

SHA512
95d8490c41a743f357f84b8b2236f4d6049fa7445e76ddd48f3efdc0fbddb6cc8f4f9dfa288880910eee18529afb85aec190dff728db8c76654c7f6568c06c9a

Download Submit
memory/1704-243-0x0000000006E80000-0x0000000006EC5000-memory.dmp

Filesize
276KB

Download
memory/1704-78-0x0000000007220000-0x00000000072B0000-memory.dmp

Filesize
576KB

Download
memory/1704-73-0x0000000006A70000-0x0000000006ADB000-memory.dmp

Filesize
428KB

Download
memory/1704-31-0x0000000006A70000-0x0000000006B6D000-memory.dmp

Filesize
1012KB

Download
memory/1704-2306-0x0000000006AE0000-0x0000000006B00000-memory.dmp

Filesize
128KB

Download
memory/1704-16-0x0000000002A90000-0x0000000002B8D000-memory.dmp

Filesize
1012KB

Download