64abb4df7bd78b749c4d0331a85ccd6c1236bb5e44284438ebc9efe920c79458

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Size

1.6MB
MD5

816614e7d9bfe7ece8dbb2bdebdd6aa4
SHA1

4bc1082c61c7f1da48d5168871fd40e91eecd2bf
SHA256

64abb4df7bd78b749c4d0331a85ccd6c1236bb5e44284438ebc9efe920c79458
SHA512

7bb058e1350fd6402a26989d3407874f0f14f8b61853717c277b2039b65a98c587e0c1b1b7acb1d14127b91d8733a1252c7551599fe7c868b7cae55e1706773a
SSDEEP

24576:9m4P03u5/7X3gV8WYzOOtb15+1P080WvbhKDoXdIC+ON:M4gu5/7X3OYzb15M0EXdItON

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "1"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "1"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "1"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "1"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "0"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "0"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "11000"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "1"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI \816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "0"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "0"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "1"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "0"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING \816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "1"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "0"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe = "0"	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2292	816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\816614e7d9bfe7ece8dbb2bdebdd6aa4_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...