c37ac379f7614de0382c60dee8470067c15397a0679cff1f6e4b7f6b40f029b6

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
Size

25.5MB
MD5

35e10c53232112b1193880e5b3ef36bc
SHA1

d31c06051210c825c394da2842031b845f94f609
SHA256

c37ac379f7614de0382c60dee8470067c15397a0679cff1f6e4b7f6b40f029b6
SHA512

864e3dfb840b3ea9ff3c0478d97da3b7e98b587fdc75252d561f009b0e121491855624b7e46de736dba8f1ac02c56cf610d84d614f83407557a4b71538a54319
SSDEEP

393216:gg+IWYDv9FYF3+x/h/13Bs+VYVY03ssoV+/Z/Zs+dEJxiTP/bciziKTDxb/rKXIE:H+7F3M/9Njf2tdEmUizB/rKYSoorz

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000015fd4-17.dat	acprotect

Loads dropped DLL 13 IoCs

pid	Process
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000015fd4-17.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
2036	35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35e10c53232112b1193880e5b3ef36bc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab4A7E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\DefaultGrLauncher.ini

Filesize
117B

MD5
64418a9ce6c5f650bf92114db26c6f25

SHA1
eb380495eaefc1a8878bb760be7a7a5e83b2b972

SHA256
80e78ae6f5f2cca5e6427edcbc779a7b422bb9f79ac63525bc7906fb17cb8288

SHA512
cff660766c8daf927dac9fd9210849d72040f418d83085b0a75a08eb40ae1077e412e1571e1a747773d3471719b9e8d055f486ed2e9e0205e620e7a487759e98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4ABF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi22CE.tmp\ad.html

Filesize
191B

MD5
8464f87975aa647c253e5403534f228f

SHA1
0a1d2571a454b76ff43ade320631853650ba448d

SHA256
85af9fb1cd755893365f5b0eb6fdb37533084dd8fea0245a12a83a4c1fa69540

SHA512
d3a38b949eb81fa35fd7d3b9af65093fc70c53348d7f472bc2bb6a2af3fb9d0a45604965e06c13d365b82838f85d24bfd7bd5ced6832bd3b9572a2adf7845a4d

Download Submit
\Users\Admin\AppData\Local\Temp\NSISPromotionEx.dll

Filesize
1.8MB

MD5
9e76a9d52f45845280024561eb0583d2

SHA1
89a92563bfcb784ce0a17b3ba02e336f59dfb6b8

SHA256
c10670e98eda82fe0984a02c88949ac1be96ca466d6d424a77ea5b67118e8d4d

SHA512
9dab31a7dd32c01ca6d6ae38f38cfe8aa84a338b3cd4d540e308e246ec09f390a00bfc698a0b739951df66356a74de925b7e2c9be22c0e06ad2dd1b891451715

Download Submit
\Users\Admin\AppData\Local\Temp\nsi22CE.tmp\Dialer.dll

Filesize
3KB

MD5
cfe0ac822ed2c3598de87fe3931c92a0

SHA1
0c603bdf81abe835621f29acd5ab2a67e670e762

SHA256
df2f6d3c9de979dbde3aa3cf0633fc8cd3215cfba5b5fc02f94338ac16cc2cac

SHA512
cacbe97b03cd2037fe28ae928b292a1558fc88ac2dc0a27e859efb413529e47f099b429e41202151f4f52fabf33c67911472edbf41132df1a7e6d1f0eac03b3f

Download Submit
\Users\Admin\AppData\Local\Temp\nsi22CE.tmp\INetC.dll

Filesize
25KB

MD5
bcf627d0db38c8e772e292b509a625de

SHA1
8ee208ff94930571b176ef92dba1c5ef5dd9c415

SHA256
6bccf372e490c49a3850e4f326c6a988e08991bbfe6e89b9c35d3efe29d304c4

SHA512
234c83b48e2f6e650a955cadcb227345f38392fc05101d21611c576307595a99e2e357be7ab6dc7d6d0a0deef501bc29dbca12907821cae9d9e2c8f17e21f7c1

Download Submit
\Users\Admin\AppData\Local\Temp\nsi22CE.tmp\LangDLL.dll

Filesize
5KB

MD5
0c44f21d4afc81cc99fac7cc35e4503a

SHA1
3d0d5c684df99a46510c0e2c0020163a9d11c08d

SHA256
8dc2be6679497994e3ddc97bc7bc1ce2b3c17ef3528b03ded6696ef198a11d10

SHA512
4e4bd35d6aa21cecbfe7a93a2ee7db8ee78ca710a4193dfe240d1067afbe10f61db332c1c85f6cc3ba404d895a959742401b615ef8ff5bd9028254c4a43a0923

Download Submit
\Users\Admin\AppData\Local\Temp\nsi22CE.tmp\System.dll

Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
\Users\Admin\AppData\Local\Temp\nsi22CE.tmp\UserInfo.dll

Filesize
4KB

MD5
b98f45a83c1d09132e1e4ada1387a6f8

SHA1
9f0a343ec5060b269d36fe1045cff14185f15d1b

SHA256
23661a4b1f3d6744fcdd1b2379e5e602e6cf6bd5950b2d19b844527b2f626e99

SHA512
cb446acd93c4dd79e81b920075a7055140b27d3e83b43ad899736a0d37e709974b27c5340a4b864e3b41714523dd4daee07b506a2c40b36f9b9d05fdd5cc2612

Download Submit
\Users\Admin\AppData\Local\Temp\nsi22CE.tmp\advsplash.dll

Filesize
6KB

MD5
505c7c214c17ac801f5930abc57d38c3

SHA1
e9a17ed8182f92bf86babbd7ba8dd8770e8ff47e

SHA256
999ebf5ef6bf51828193deaf7697e6d22419e437c65e603bffa0bb2acc7f40c8

SHA512
30686f361db9d81c95912700af530529d4d89bf6b514a63ab5db6b20efc443b87aef44b598e45d33adee448ec1b6573ca035a1d20e11c78ea8253f1ecf5ebf38

Download Submit
\Users\Admin\AppData\Local\Temp\nsi22CE.tmp\md5dll.dll

Filesize
6KB

MD5
7059f133ea2316b9e7e39094a52a8c34

SHA1
ee9f1487c8152d8c42fecf2efb8ed1db68395802

SHA256
32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f

SHA512
9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51

Download Submit
\Users\Admin\AppData\Local\Temp\nsi22CE.tmp\nsDialogs.dll

Filesize
9KB

MD5
0d45588070cf728359055f776af16ec4

SHA1
c4375ceb2883dee74632e81addbfa4e8b0c6d84a

SHA256
067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a

SHA512
751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415

Download Submit
\Users\Admin\AppData\Local\Temp\nsi22CE.tmp\nsJSON.dll

Filesize
18KB

MD5
e89c7cd9336d61bb500ac3e581601878

SHA1
45b2563daa00ba1b747615c23c38ef04b95c5674

SHA256
431fc2ed27d0b7a1ce80de07989595effcc3ffb1dea1af6c0e178b53f6bd2f1e

SHA512
09485a354ac4ace6084cb6fcbd92eee8488074763c8443638f78e655e45e8aa0fe40a45d4ce0dff116ed3a4bb7bc4d7d845a6ccf0e0bf35533ce81626a8db06f

Download Submit
memory/2036-136-0x0000000004660000-0x0000000004661000-memory.dmp

Filesize
4KB

Download
memory/2036-24-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2036-148-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads