1634dc099b7326fbd8f47ef057890e7474fe6904d96ee408fde846ab6a9b02a4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Size

606KB
MD5

91f54808a7ee9cdbac05f75e3ba3c7b8
SHA1

0e7153795f0f4caf84da53a36c00b735dc639040
SHA256

1634dc099b7326fbd8f47ef057890e7474fe6904d96ee408fde846ab6a9b02a4
SHA512

5fece7b833ecc29c6a98c110b0d9ad4e9d2f6ca70c25a6611674af446f92850e13fb01c96d514d4d4ef7e34779b06f1145f66bd9a89f618dc2fcf0d71a80c95d
SSDEEP

12288:7Mdco3AoUVKQV1xEat4IPcflAoHX0JNmu1facYF0j:7qQoUVKUn3F+XwpYFE

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe:typelib"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\subjects.bourse\CurVer	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\TypeLib	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\ProgID	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\0\win32	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\HELPDIR	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\TypeLib\Version = "1.0"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\Programmable	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\subjects.bourse\CurVer\ = "subjects.bourse.1"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\TypeLib\ = "{8C261F86-120D-4A4D-9799-7EA9341926F8}"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\ = "InstallerLib"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\FLAGS	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\Version\ = "1.0"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\TypeLib	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\Version	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\subjects.bourse	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\HELPDIR	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\subjects.bourse\ = "Inst Class"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\ = "Inst Class"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\ = "IBoot"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\subjects.bourse.1\CLSID	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\VersionIndependentProgID\ = "subjects.bourse"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\Programmable	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\ProxyStubClsid32	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\subjects.bourse.1\CLSID\ = "{e79e8368-dcc0-435a-8eb7-fd549df3bff0}"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe\""	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\VersionIndependentProgID	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\LocalServer32	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\Version	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\ProxyStubClsid32	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\subjects.bourse\CurVer	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\0\win32	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\TypeLib\Version = "1.0"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\TypeLib	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\FLAGS	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\LocalServer32	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\subjects.bourse.1\CLSID	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\subjects.bourse.1\ = "Inst Class"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\FLAGS\ = "0"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\ProgID	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\subjects.bourse.1	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\TypeLib	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\TypeLib\ = "{8C261F86-120D-4A4D-9799-7EA9341926F8}"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0\0	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\ProxyStubClsid32	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\TypeLib\ = "{8c261f86-120d-4a4d-9799-7ea9341926f8}"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0E48E18-95E1-4991-A40F-DAF8EA1EEDEA}\ = "IBoot"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C261F86-120D-4A4D-9799-7EA9341926F8}\1.0	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\ProgID\ = "subjects.bourse.1"	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e79e8368-dcc0-435a-8eb7-fd549df3bff0}\VersionIndependentProgID	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe:typelib	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3036	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
3036	91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe"
1⤵
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\91f54808a7ee9cdbac05f75e3ba3c7b8_JaffaCakes118.exe:typelib

Filesize
7KB

MD5
28d43106c063ec06c2d8f2bb586dade5

SHA1
049d2dbf48816c7dfb2834a0d114be3bb8470642

SHA256
406e5599749d4b7ff770cad4def1613502973b7e54fa42ef711244bb16f5569f

SHA512
9589293c6af354d59f4e3843f4f1f88a1db6c2c748b1929a8626a5bc228193034cbd6ac20983bc70cb2f7126416004e51d597858c6c0aa6fdacf77e8f0f70080

Download Submit
memory/3036-0-0x0000000000360000-0x00000000004E3000-memory.dmp

Filesize
1.5MB

Download
memory/3036-11-0x0000000000360000-0x00000000004E3000-memory.dmp

Filesize
1.5MB

Download
memory/3036-13-0x0000000000360000-0x00000000004E3000-memory.dmp

Filesize
1.5MB

Download