Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
26/05/2024, 02:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe
- Size 780KB
- Sample240526-c2vfmsce67
- SHA256 5ed1918a1897ec2c8d6cff0426a47d4b6d8e65d944d6adfdec755fa58688d4fd
- MD5 74123a001e2a4ccf553ff792d241f7ab
- SHA1 a57c28ec438404a87b29aea6617a47568e063091
- SHA512 146e861b7f68cefa774a25a009be84d185e56f89f73cf1710f2fdd762db2d880cc59f6659cb8a3805ab14892334e66cf5de55dd1af5b52ea5cd04effb788f2f4
- SSDEEP 24576:qhiDoNJQWSSol0k8zh6HIeSDoLLheUgrQYq54/0J4CxvARL4k:eiDPWSSXkqOXS8LFBIQYX/0J4ChC4k
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2576 setup.exe - Loads dropped DLL 1 IoCs
pid Process 2084 74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe - Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\50952c96\\setup.exe" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\50952c96\\setup.exe" setup.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32 setup.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main setup.exe - Modifies registry class 36 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node setup.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0" setup.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32 setup.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\ = "JSIELib" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\50952c96\\setup.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\50952c96" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32 setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib\ = "{7E77E9F2-D76B-4D54-B515-9A7F93DF03DF}" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\50952c96\\setup.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS\ = "0" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326} setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326} setup.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5} setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\ = "TinyJSObject Class" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\50952c96\\setup.exe" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version\ = "1.0" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0 setup.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0 setup.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2576 setup.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2576 setup.exe 2576 setup.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2576 2084 74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2576 2084 74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2576 2084 74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2576 2084 74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2576 2084 74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2576 2084 74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2576 2084 74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\74123a001e2a4ccf553ff792d241f7ab_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\50952c96\setup.exe"C:\Users\Admin\AppData\Local\Temp/50952c96/setup.exe" ProfileFileName=step0.ini2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\50952c96\installer\boot.dat
- Size 1KB
- SHA256 0f1d6e066ebc9ed29cc2f194fad5091431a57eb85e13fdd19d1c8881c9402e71
- MD5 82ff009dd3236db90393cead19bd2b16
- SHA1 3b9eab7281a500960d6598316db7b8299970d8ba
- SHA512 47bc6609654812719030e470f949b2af139346937cb689d078de731d57278f2743da5a1cf2dd71bbadb47251be7e5b784c429ba2769559e2d4dcddc978fbe8f1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\50952c96\installer\installer-config.dat
- Size 4KB
- SHA256 e6283313fa634034a1251471b5517fa9264c55f1e8008af103dbb13242dcc88f
- MD5 26346960decad3a50d16370897784854
- SHA1 a2a5986399f33bd62cd15757895475f818291302
- SHA512 1344d6c3201e33ff26063c58b2030b1b16fb8bcab951caa9bfe9cce4c09d190881705a7eafccc6ccfe0bdf1abf71ae360ea3e3ef10ee6ef0cfaf0eb1aba39e54
- SSDEEP 96:0FGhaK/dwLj/wJI6ivGM1DXTo8SDZOTx0fmcKZexsbdVqqq61WYMPD:04/dejB6i+ejDSwzJDqei
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\50952c96\installer\installer.dat
- Size 36KB
- SHA256 ceee1f89c72361136d3c7f884c9a54ccf3e99aa25fbc0aeef4c79c9f1e38307e
- MD5 298dc9fe1774bad46acae8aec86b8a40
- SHA1 f9f5564461b94e309043e2c555b645fdb69611b0
- SHA512 a47c66bd350774b0932a42062952e9cd260daf0cf4b6a2f5ce886a24e592bb113aaa0d386c712d7a63ef3070f85540a8125579a524269091684e59ccc601f2eb
- SSDEEP 768:EjjN1MdOj5LocVCVWPQ2kK/IFoJlIYEjjZzAcgifoCWvQFgDvIhdjxJ2yU6:EYONLocVL5kKIMIYEJAb65W4F86d9p9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\50952c96\installer\new-screen.dat
- Size 2KB
- SHA256 ae780c4499c3560092e6b5bcbf4ae596f7b0df3e77d0d3cb3eeb33b54eeb2dfe
- MD5 ff3ac2ce15df8c6e09677fff184dd67e
- SHA1 a9b938df0cb6338c557c118766e25acc97bcf1f8
- SHA512 a7fdd31a34c45d608f99afb06c9ac54c2218603f1d3828af13a0060e19f2d4903ddc253f3209455acff7459679e3514cade3289e21c1f3f598a07b7e8e361ad0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\50952c96\installer\step0.ini
- Size 22KB
- SHA256 2aa30d3d986d194fcf58c5d91ab82bd55fe1cc3ef6c991c9f21dba63059b01cd
- MD5 c1ee4d6163313c158c4bf5ff3ee32ab3
- SHA1 c0287f586ef0fb3a299d9cd6cd97443f790b381c
- SHA512 29ebc2f74e068b2028f1a0994b36a4a7fc0ff73cedbba1ccde86d3a12c137a28c176685183a918f384fd36e86812b51ee91d9b2dff0248ce4180d9d81112be6d
- SSDEEP 384:YeD5HaMLy7bRDzgdgC+foSE3czAa223PUm/2/7nPYhRCyoWC9nY0OklTHj2J2YMX:1DZDy7bRDEdgCELd728Um/O7nwhRC99R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\50952c96\installer\step0.ini
- Size 13KB
- SHA256 f012b2c07d6b3a9699ed377777cd6db0b281d628365d8f393f251bad2560892d
- MD5 0adba4532efd575d68ae8fac700f5303
- SHA1 5cfc6b8d63b5c77b178ee916014ef713a4fc2e56
- SHA512 af68c8992ec524c037a07a35894d7cabd48f1bbc2bf2581b57083f91ee995e48f013dfecec22ac984be2d51537c29c73c90a59341f7203bbf87d9f9d06e93786
- SSDEEP 384:zQtW++LpZk3/Fo+Svik4+tAa76axuX/f8qA:zQt3/6viZ+H7/IXMh
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\50952c96\setup.exe
- Size 1.4MB
- SHA256 747193c4bdfed0a0d9dc2cd79e9682787169467c90e89d165026ccc220142cd6
- MD5 c3bc99a2f410a5bede595c6a35aabc44
- SHA1 cf513259f468b9b15d1749dbe60d215c0b76098c
- SHA512 ddc3eee00d14947fc7cab3ff870328e9046c62357ef1a0ba809ec846a404e3797a1bead5c85ba393ef2536589ea69293da3eefa57e1e99f33b60912c1f1908b3
- SSDEEP 24576:yqFvSmxsGn4jlCHkdxuHnyjJvblrgOehMAFtwIRPPXFJa1TFpQl8C:y6dxsiwCEdxuHSbWwIRPPXF0/ql8C
- MD5 SHA1 SHA512 SSDEEP