2045e76106298ad2f33e3fd3a7a05045985b15a0f79aac1784ca1e5151897411

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cab4bff8c225acd271725c7fb7fab42_JaffaCakes118.exe
Size

649KB
MD5

9cab4bff8c225acd271725c7fb7fab42
SHA1

39e60f408fdf5653133b9056bebff6abd2269a80
SHA256

2045e76106298ad2f33e3fd3a7a05045985b15a0f79aac1784ca1e5151897411
SHA512

fc03649d31816f9e18ff7792d5a36555704660f2d54a30fc430fbcd544ded932e86240a0a25119d513c65e0459bbcc14aea7a6121536bab8c3c75c47dc2ea33f
SSDEEP

12288:ukgQFa1bEf+IVSxkdsC1PgmmtF1H2ph+7ZC+9UnbnEeCsATpBvZempJrVVoYywb:RgQFAEfzwC1PMdUgITnEeCdz0EVXywb

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3012-0-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-6-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-5-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-103-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-104-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-106-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-105-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-107-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-150-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-151-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-153-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-172-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-174-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-173-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-175-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-177-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-178-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-179-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-180-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-182-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-183-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-184-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-185-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-187-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-189-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-190-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-192-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-193-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-194-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-198-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-199-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-201-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-202-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-205-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-207-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-210-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-211-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-213-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/3012-214-0x0000000001C20000-0x0000000001D64000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	9cab4bff8c225acd271725c7fb7fab42_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3012	9cab4bff8c225acd271725c7fb7fab42_JaffaCakes118.exe
3012	9cab4bff8c225acd271725c7fb7fab42_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3012	9cab4bff8c225acd271725c7fb7fab42_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3012	9cab4bff8c225acd271725c7fb7fab42_JaffaCakes118.exe
3012	9cab4bff8c225acd271725c7fb7fab42_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9cab4bff8c225acd271725c7fb7fab42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9cab4bff8c225acd271725c7fb7fab42_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ish259396933\bootstrap_26917.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\css\main.css

Filesize
8KB

MD5
0336ee293a305a3004328e080d9cc44f

SHA1
09d700690e0d18ebdaf0d36fac8932d0c92c84a1

SHA256
6bdf1895a3ccace156c2d6b96783d91a85252f765182086163efd52fd2af9e3b

SHA512
5096ce7e3718337ab4cae5e85e9df3dd00a42c5d8650a9cd2ca7b4fe14d277b79f65745c958519e0438bbb9bdb96727ee08d7501597ef78eab0a34c5016cccf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\css\sdk-ui\progress-bar.css

Filesize
506B

MD5
5335f1c12201b5f7cf5f8b4f5692e3d1

SHA1
13807a10369f7ff9ab3f9aba18135bccb98bec2d

SHA256
974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

SHA512
0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\Close.png

Filesize
1KB

MD5
b5680d31a09579da2f6e57dd2dc4b525

SHA1
caa1ebc4abbc86cdf33ef0cb496ee54f2c475575

SHA256
937a69b5d26a5dcacb1b81cd90a2d05fd55618af4e32a7f2e9550449f4163bbc

SHA512
d4a95c723b810355fb744120fb38660076b1724e6203c1f10f92165d2f097148bfa639279f933af329c44d8a1ed0eecaecbcad16f6502229ce3212fa50161ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\Close_Hover.png

Filesize
1KB

MD5
f992568de636b9614a1ab918bdac0a18

SHA1
fe1befdc20081e40bc06a0a4b92c92d55e289d73

SHA256
9e0c56968ebe4c50d3b0687db6679ec7b636f94a87ac4712ecbeee8771ba5465

SHA512
83bd3a449e9e2c844f4fe1bc1f18a7819453114200d55948256e994b36f4af92636ddcb63cf48d5641beab4d1bb2dd9cb79e3df9ba874d4bb30f831b5c8205ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\Color_Button.png

Filesize
3KB

MD5
3531ab8c31fe6001503ea47aca6573cd

SHA1
ca48c7fe2c0d950d774e4c249b835006a67d3ff0

SHA256
9c59c94c72450cf44d9ccf04acf190cbf6be98e764b837da9f81b729fc34d5f8

SHA512
9cd12be3e361911fe6cc0ccd965be126ec2aa8b7a79bc46aa179db64529e744e476349340194ddeb2f2b6144a929de97eee768787f25a49a05876e1b1c81a871

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\Color_Button_Hover.png

Filesize
4KB

MD5
e8f7d6ee464ba0300f7cb02ae4b32e1f

SHA1
9849add6f7bc88d0821696d3c7c154db141454f0

SHA256
cd7b0ccdb7d8693e0b7827d8de9ba29353114941965a66e4fe882affde840356

SHA512
6ef8708b619b3ffb76fc0d7c30570f3f0a2d112fad88d06f2137942109b3eef17e3eee6d717993844855bc43bcfd9c402ac217524eaf6e36c6d8a373ba3defa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\Grey_Button.png

Filesize
3KB

MD5
740f01955863a49511cf875900c48d14

SHA1
b082db44f83c3901383171892eaea364d1745e08

SHA256
cfed40934aacbaaf8f551138278da30570c4269165354c47d6900581594264d8

SHA512
9549fcc98c2421b9c8a9f591a0f9b12df53d541416efd3a8ce28b482288995cebe9f6f09136ed91fea9a158d75a3c969bf8a49ef31f35f7f7604b163f9d4a2c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\Grey_Button_Hover.png

Filesize
3KB

MD5
19e59fb2af9f6f2b47edf6936ce4a0ef

SHA1
821bf549fb00206800045b693f19a2cd273b2144

SHA256
f64c1b3e5bd79363e65ed44ea8c5791c06d118acbee1191a4753edcd18d711af

SHA512
64de8134ac7e322411189db8c8d1335e87e7cfd63bd58aba3f6e4b81459d9ded41f3c9f87b25018b6dfb9db8255a8083e04244e3292420887c3c01e9caa9a5e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\Loader.gif

Filesize
10KB

MD5
57ca1a2085d82f0574e3ef740b9a5ead

SHA1
2974f4bf37231205a256f2648189a461e74869c0

SHA256
476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e

SHA512
2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\Pause_Button.png

Filesize
577B

MD5
84b37cb510f50c8fea812eb308d3f03f

SHA1
d141a79feb407506709f051e55c55438a12fd3b4

SHA256
7bf800336671204de36b7d1f6ceffdff830040f51d21bc44f220f68d72cf492b

SHA512
3222cb5772a4e9b20de253914c0856c7e6383567df68fcf287801f6f79248f65957515e7ec4a44db1fbe910afeae8ca3349295c4bdf03df6aabde36f2aaa6b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\Progress.png

Filesize
104B

MD5
35a600a752d3074501de31a516860499

SHA1
51eac62cf77a0b88a3e9cb9ee6f85def21fd4bcf

SHA256
14e064857751b23da7bbe40861ef4caf99b2496227507b8e3108fbac6d901f75

SHA512
046ec179571d239bfb2d51be9837f96d9afebf2e5db77bba0f4a25ce8716d37581a3f9753bd2dbb04c47711699a9d93987bceb71df0b8becf8c577d660320069

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\ProgressBar.png

Filesize
812B

MD5
eabb61abba55f80af418fa1128d1548d

SHA1
a5ee1d55de2cc60966039120c830fc19cefb0351

SHA256
717f3f02f5d5fd1478b6d2ec44acef6e70bb8f1adcf2dc030c08b92e851737e1

SHA512
d232072c9540bf0e2fd56f353c2cc83518eabf8282cc02d9f8bec81c0341287ada29ba79f2a515d68722658686b6cce97be138a48f44409562d9a567af200bd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\Resume_Button.png

Filesize
718B

MD5
9d31583bcfad58a6b9ddeaf44549a5e6

SHA1
98f4c693af708e02201de2aee31fe094dc3b0a9c

SHA256
e466a2db2f755d9eb68619439af37ff4e45559b7a3f476e226ab2a11aeadae1a

SHA512
9ddaaad53375f4d2874fe5c98b6782202d2bd975cdd9363796986dc7567368b94d9ec1aa3e839194097838b787bbd71d574540cf5b04fd04f10fa80d6a89e695

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\default_tb.png

Filesize
19KB

MD5
70e70599d4b853df0f12f6cb0e04695f

SHA1
6e3a721aef65625bf99b639800476150d262dd4b

SHA256
87af4027e8f89459463bdd73df7b928b883eefb20514159d3a1a4be0d39e00c0

SHA512
1efcf8af09cf857b3850cec43a88fc8c0992e3b04f78ad2c71b84c2ac7775e745df211582694588b29217aefb1ae02b29b94c2cfe52b5d32bdafb9dce73b9920

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\default_wi.png

Filesize
27KB

MD5
1cc2677e3e29e45e538985839cff2b42

SHA1
2dab653eb20be72b034a38dc1fcebbd18f079c86

SHA256
9216d98a6574dfadacdc8321dc435454cb72c589b3ee8326a9b946966f756d7f

SHA512
25575fea9abb1491b5a5853244a9b655ce05f64d98f4b79134674f2d9a560a5af405c1783c9da4a07cfb38b51d060c7a70890c70df6c1c8f4b01e041aa4f649f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\sponsored.png

Filesize
2KB

MD5
e3758d529f93fee4807f5ea95fbc1a6c

SHA1
3a9a1ba234e613e5f808c3ffeda05a10a5dafe00

SHA256
8d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303

SHA512
e891552bee3aa10247cad1fcc510331077016a6e71d46827be2dd46017f943c5acc2c1506b41217880d35d52a94989923ad0a345f8791da4bb379eceefe3c407

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\images\welcome_BG.png

Filesize
1KB

MD5
404bf6df1951582ed822ce27b09bb98e

SHA1
a47305533f69535a258580ee6788cedafd1f3e6c

SHA256
c2f126efa2ac662355e8c5eddd315d16f6cfaff1b8345fb14e5730590dcafcce

SHA512
3acb516b3a430ba276105490bda11f566c3f50c337a291a9bacf215c2a22b31dd7a391d7aadbe351eae326b3f275d133de5788686cdcd58a5bce81f6b912529b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396933\locale\EN.locale

Filesize
4KB

MD5
d9b9e701327b46246d3fef87cb858a40

SHA1
7d3b9ae1800395d5eb88a54fcf89688d1673e4f7

SHA256
2e00027d7272d095b6c3c0ad796ffee820cb12738590b92bcfa5cd10f6f9f7e9

SHA512
dca1fdc79003a38525cec81c184e5d1423c80388607d9016264500781dd90960a5701ee6372722467dc9b60a0499f36fab102f91ecaa39fda633905adf3d2bab

Download Submit
memory/3012-178-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-182-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-106-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-104-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-103-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-5-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-150-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-107-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-151-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-153-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-6-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-1-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3012-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3012-172-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-174-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-173-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-175-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-177-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-0-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-179-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-105-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-183-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-180-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-184-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-185-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-187-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-189-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-190-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-192-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-193-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-194-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-198-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-199-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-201-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-202-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-205-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-207-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-210-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-211-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-213-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download
memory/3012-214-0x0000000001C20000-0x0000000001D64000-memory.dmp

Filesize
1.3MB

Download