95bc492108b06733e1c3506151465cd32352d7e9049951e9ca9edd33d80092cb

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
929130665f97d24f3f8dc2ff60386851_JaffaCakes118.exe
Size 2.2MB
Sample240603-vr6p2add2t
SHA256 95bc492108b06733e1c3506151465cd32352d7e9049951e9ca9edd33d80092cb
MD5 929130665f97d24f3f8dc2ff60386851
SHA1 6b1d321431d88bae71adcd9d4b0845d65654c4df
SHA512 16bb65e4e002701209fc46c8250198ab32e39e06aed86109894f0fcfc6f214e82e2c1142bc3861e4fb8dc215c5ffaf8822a3cf367b4dcedc94cfde2a7aba9753
SSDEEP 24576:h1OYdaOSqU2Uzf51ilCfBJyrWSSTDBXEZc78KU88Sghr3AzcC:h1OssqBI51ilCfAYvYhr3o1
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	nf6QmIlpOe7kvfz.exe

Executes dropped EXE 2 IoCs

pid	Process
4916	nf6QmIlpOe7kvfz.exe
4944	nf6QmIlpOe7kvfz.exe

Loads dropped DLL 1 IoCs

pid	Process
4944	nf6QmIlpOe7kvfz.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\__aHTML\shell\Edit\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RWUMSX.tmp\\nf6QmIlpOe7kvfz.exe\" target \".\\\" bits downExt"	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.aHTML	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.aHTML\shell\Edit\ddeexec	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\__aHTML\shell\Edit\command	nf6QmIlpOe7kvfz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.aHTML\shell\Edit\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RWUMSX.tmp\\nf6QmIlpOe7kvfz.exe\" target \".\\\" bits downExt"	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.aHTML\shell\Edit\command	nf6QmIlpOe7kvfz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.aHTML\shell\Edit\command\ = "Notepad.exe"	nf6QmIlpOe7kvfz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\__aHTML\shell\Edit\command\ = "Notepad.exe"	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\__aHTML	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\__aHTML\shell	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.aHTML	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.aHTML\OpenWithProgids	nf6QmIlpOe7kvfz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.aHTML\OpenWithProgids\__aHTML	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\__aHTML\shell\Edit\ddeexec	nf6QmIlpOe7kvfz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.aHTML\ = "__aHTML"	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.aHTML\shell	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\SystemFileAssociations\.aHTML\shell\Edit	nf6QmIlpOe7kvfz.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\__aHTML\shell\Edit	nf6QmIlpOe7kvfz.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4944	nf6QmIlpOe7kvfz.exe
4944	nf6QmIlpOe7kvfz.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	nf6QmIlpOe7kvfz.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 4916	3364	929130665f97d24f3f8dc2ff60386851_JaffaCakes118.exe	83
PID 3364 wrote to memory of 4916	3364	929130665f97d24f3f8dc2ff60386851_JaffaCakes118.exe	83
PID 3364 wrote to memory of 4916	3364	929130665f97d24f3f8dc2ff60386851_JaffaCakes118.exe	83
PID 4916 wrote to memory of 4944	4916	nf6QmIlpOe7kvfz.exe	84
PID 4916 wrote to memory of 4944	4916	nf6QmIlpOe7kvfz.exe	84
PID 4916 wrote to memory of 4944	4916	nf6QmIlpOe7kvfz.exe	84
PID 4944 wrote to memory of 4896	4944	nf6QmIlpOe7kvfz.exe	85
PID 4944 wrote to memory of 4896	4944	nf6QmIlpOe7kvfz.exe	85
PID 4944 wrote to memory of 4896	4944	nf6QmIlpOe7kvfz.exe	85

C:\Users\Admin\AppData\Local\Temp\929130665f97d24f3f8dc2ff60386851_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\929130665f97d24f3f8dc2ff60386851_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\nf6QmIlpOe7kvfz.exe
  .\nf6QmIlpOe7kvfz.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\RWUMSX.tmp\nf6QmIlpOe7kvfz.exe
    "C:\Users\Admin\AppData\Local\Temp\RWUMSX.tmp\nf6QmIlpOe7kvfz.exe" target ".\" bits downExt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /u /s ".\\z5aq02OmZcKogg.x64.dll"
      4⤵
      PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cjw.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\ijedgcnijlobphbkhphfngamjnbmbkpn\Cjw.js
Size 6KB
SHA256 fe7dc7a269338db92cf45963645e85ff5c04a63ad9be7ffe7c037306c55273b8
MD5 8e7120f0306862e410f7b83c6c55b8a6
SHA1 0e793e0da2e9ae1a849f69399d4f7add5e1355a6
SHA512 e183f272b4311fd08da37b26d06a4c948b766a7b381050b7016395b8764c37ba2f6e35f6d1b910a7965d2b35071d1ac316f161b0093dc3402da3f4c7ca3a00ed
SSDEEP 96:93c7HJJ0vOai0NxOT5fUAy8lOlECC5esUkx8clECh8lN8l/lECJ8lsL8l3WN0wvy:93c7xVfUAMJxpkbJxJZi7qpIY9CL9
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\ijedgcnijlobphbkhphfngamjnbmbkpn\background.html
Size 140B
SHA256 a5c1fecdadda9c53a25b6cb166423c53f616358da0f2d0898a5b59a5cad27e02
MD5 aa2abe088b6b388140e82d91033cc4de
SHA1 2e0dad6aaaa302be085e3cbdee845d14940915b5
SHA512 fa0f50d5d0a3ca28524f51a252636abceb4536b0451116dcf1250c7d3ef7995600466ee14c2caaf2a9d58a19242894ea1b47322e5918da32244d08c2d7256dd4
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\ijedgcnijlobphbkhphfngamjnbmbkpn\content.js
Size 144B
SHA256 332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
MD5 fca19198fd8af21016a8b1dec7980002
SHA1 fd01a47d14004e17a625efe66cc46a06c786cf40
SHA512 60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\ijedgcnijlobphbkhphfngamjnbmbkpn\lsdb.js
Size 531B
SHA256 ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
MD5 36d98318ab2b3b2585a30984db328afb
SHA1 f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA512 6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\ijedgcnijlobphbkhphfngamjnbmbkpn\manifest.json
Size 503B
SHA256 c3e73ad0c9ffeea692a01e960e89b31c6d44c371e0dd96c2fb58b47877ed6148
MD5 c674384f70f19a45e490fdf98d5e9f47
SHA1 1c067a1d4980659ec41b5e7362587bd9c43fff25
SHA512 fa4d12805d2dce15a60d21001deae9e267af3ffaef21e7ff9aa68aac0e1a0b7edd48229c6cb3738edffa9998ca229cb2f36cd85b8c16ece0056129648d1353ab
MD5 SHA1 SHA512

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
MD5 df13f711e20e9c80171846d4f2f7ae06
SHA1 56d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA512 6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\[email protected]\chrome.manifest
Size 35B
SHA256 61ebf806756fa42dd9a660c37bb3480882d3d3d432ed5a241640f161896e0273
MD5 463cecc82cf37de28f52060e97c55734
SHA1 f81e12ed731e481c632384dda63a0830486e5e57
SHA512 3c24312ca4da1a62418cff2f539774bad191cb9605c93c9dc95b77fd1ef274d3a54ba87d2fdb7e6be47cb09224e8782e43e4dee8cd9fbd1e763f2694abc6438f
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\[email protected]\content\bg.js
Size 8KB
SHA256 8c388a02b932ff57e6e7b265baadec3ede5703e38587d4cd473f7b7ecb771634
MD5 b3b49a0128fd1bbaacf13df212eb3512
SHA1 d7d87fba11eb375316ea12e3957519fbc1717c93
SHA512 7ed0392ae6e7fcf8fabc87ab40ee3805c19991840fa6411eaf25cc2ffd339aa6748b29d76c970d738e27561cd85ad149df3e8ec4b7654fc1f13e332ac746031c
SSDEEP 192:Lc7gInv4YEoVQtehieMJxpkbJxJZUVqkY7DLOW:Qbvr0xnCHoTuDB
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\[email protected]\install.rdf
Size 599B
SHA256 2c48c0f536ccc9dc1fba5e181f0de083f60bf8ad1589827a9cd8bc877123fa47
MD5 0abb4fa5c6d2c9fbfab04dbe95da6b7e
SHA1 ebeffccdf058038ce6429a79d474891fcb5243ad
SHA512 2f9bfbb1a16f59689dd833bf70598ca09a592081ef4805aa215ebed83ed62f23ce90c15b98ea359db77e3865e17fa34959575893d696a50b640aabe277f94c03
MD5 SHA1 SHA512

Submit Download

nf6QmIlpOe7kvfz.dat

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\nf6QmIlpOe7kvfz.dat
Size 14KB
SHA256 cc6f8ca24d49fd61e1efff28a048cce88a9063b2aa4e876e719118c823c0252b
MD5 3fcbb10a83d8b2ced4ff98f49a007c98
SHA1 e355a15cf2b797cf61fcb668e67a37d12b397a5b
SHA512 bcf47524e03c56498a2a5bf2bf9b8b780366224d8b8d17a7effc11dfc66be3a4403aee0aaa3ebf1d7e87a5037765521b6ea063d5cdee520d329d3be14a609c48
SSDEEP 192:tvkrzhn1j1FOdtYeDvoZ7N1bNUnoHmLyglKglLglTglqglkglRglLgl1ggL8eRGX:gh1TOdPvUv0LNF8klvi87L8r3MAP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nf6QmIlpOe7kvfz.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\nf6QmIlpOe7kvfz.exe
Size 218KB
SHA256 7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4
MD5 9f6c52eec607111136cd222b02bf0530
SHA1 57f3815d0942e3b0a9bef621a7b4971f55fc74d7
SHA512 6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54
SSDEEP 3072:L8sWeQCnJX7YN7Fq/8xnOjbC27isT+1BYfhmqAZ7TnUA5:L8sWeQyKFqU1aC2UumqAZ77UA5
MD5 SHA1 SHA512 SSDEEP

Submit Download

z5aq02OmZcKogg.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\z5aq02OmZcKogg.dll
Size 863KB
SHA256 05d5a9b8432c53575b27026abf11cf098acf80ff506f4faa0611af9e75c5f2a3
MD5 4df0f6f3ec9096b9ca6231949b8304ac
SHA1 85f75983c234858e732a47656740323cd4d61b20
SHA512 42f858e95a4a6efbd005f553d27784490f3c209e63ffe005ae7223ca7b3d4189906911a7678d22c43882069b3735fa513f7a9ff7634be25503647f2b82f45c02
SSDEEP 12288:viMsCmaJsGUwaEFPJyr1ZS/bl+/WPSSfMD:vilCfBJyrWSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

z5aq02OmZcKogg.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\z5aq02OmZcKogg.tlb
Size 5KB
SHA256 495c35bf29cd1c6e4a736db79e87203b6fd0c1345343dab958e5d9a4b087754c
MD5 1ca45b386c7b01e1bd45ef4e291d3f70
SHA1 dcabb955bc45b182231459d7e64cba59592c907e
SHA512 87dc04954e21af239f1cd8a300d7ea34c0de9580598080df8e2e75d347ad0232770b37d648db772f5d854a553f395a1fe9c010071ee76024f64ed819371fe752
SSDEEP 96:4lqqY3Oxw6AnCYiie3TJLAiePZj/dvuPUKOptYm:9+j3TJ0iePZ9dZptYm
MD5 SHA1 SHA512 SSDEEP

Submit Download

z5aq02OmZcKogg.x64.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS7213.tmp\z5aq02OmZcKogg.x64.dll
Size 945KB
SHA256 9ba6a88945d56f37b6f5685a0baa1b02642280ff8520fd43f2163a86b1e72248
MD5 45bd1e6fc13716e39dfb622bd13a2fe1
SHA1 f11b486d79fca7579c2e94b9f804c35cc02e95c3
SHA512 4498952a634d8c67c6a50f44ce9ccc0584bac37a20b2c044cf64879d8fef70c0d721ce72a1b66ea633706f27a5113d796cd1231856011d54a8cbb185ede702f2
SSDEEP 12288:dpqyvx00kTzJEWcFDsvXWthTWeBV1EZcmM8KUbtm8SJ+hr3Azc:fDBXEZc78KU88Sghr3Azc
MD5 SHA1 SHA512 SSDEEP

Submit Download