932bc4419815dfc770e7b59a02eb42226d81ba10c43c5793a7d69780cf5756c9

Analysis

max time kernel
75s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
Size 4.2MB
Sample240611-l6afpsshlf
SHA256 932bc4419815dfc770e7b59a02eb42226d81ba10c43c5793a7d69780cf5756c9
MD5 9dcf99215e5c296c31be8fea3fdeba9e
SHA1 e77ceab18994c57377db68130201906d8ad6628f
SHA512 fdae131add4a2b79ca0e0a0ebbaa67d5918ee2d4a30431250cf5044d268bc1054414a3d9c24172a3f61b040658363948b99fa7d1179fba285efceff364b7d4d6
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciiCFwlYvoGxUSJpXP:HmRIDQciiDsRXP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
336	275.#.exe
2524	544.#.exe
736	605.#.exe
4940	784.#.exe
4644	519.#.exe
2248	855.#.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	275.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	544.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	605.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	784.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	519.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	855.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\	605.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	544.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\	605.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\	544.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\	275.#.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\	275.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\	605.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	544.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\	605.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre8\lib\	784.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\	605.#.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\	275.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\	544.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\	605.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	544.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\	275.#.exe
File opened for modification	C:\Program Files\Common Files\System\fr-FR\	544.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\	275.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\	275.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\	605.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\	784.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	544.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\	784.#.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\	784.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\	605.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLSTART\	605.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\	275.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\	784.#.exe
File opened for modification	C:\Program Files\Common Files\	605.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\	605.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\	784.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\	275.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\	544.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\	544.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\de-DE\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\	544.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\	544.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	544.#.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	275.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\	544.#.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	544.#.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	544.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\	275.#.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe

NTFS ADS 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	275.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	544.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	605.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	784.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	519.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	855.#.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2972	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
336	275.#.exe
2524	544.#.exe
736	605.#.exe
4940	784.#.exe
4644	519.#.exe
2248	855.#.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 336	2972	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe	84
PID 2972 wrote to memory of 336	2972	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe	84
PID 2972 wrote to memory of 336	2972	9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe	84
PID 336 wrote to memory of 2524	336	275.#.exe	88
PID 336 wrote to memory of 2524	336	275.#.exe	88
PID 336 wrote to memory of 2524	336	275.#.exe	88
PID 2524 wrote to memory of 736	2524	544.#.exe	89
PID 2524 wrote to memory of 736	2524	544.#.exe	89
PID 2524 wrote to memory of 736	2524	544.#.exe	89
PID 736 wrote to memory of 4940	736	605.#.exe	91
PID 736 wrote to memory of 4940	736	605.#.exe	91
PID 736 wrote to memory of 4940	736	605.#.exe	91
PID 4940 wrote to memory of 4644	4940	784.#.exe	92
PID 4940 wrote to memory of 4644	4940	784.#.exe	92
PID 4940 wrote to memory of 4644	4940	784.#.exe	92
PID 4644 wrote to memory of 2248	4644	519.#.exe	93
PID 4644 wrote to memory of 2248	4644	519.#.exe	93
PID 4644 wrote to memory of 2248	4644	519.#.exe	93

C:\Users\Admin\AppData\Local\Temp\9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9dcf99215e5c296c31be8fea3fdeba9e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\275.#.exe
  C:\Users\Admin\AppData\Local\Temp\275.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Users\Admin\AppData\Local\Temp\544.#.exe
    C:\Users\Admin\AppData\Local\Temp\544.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\605.#.exe
      C:\Users\Admin\AppData\Local\Temp\605.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:736
    - - C:\Users\Admin\AppData\Local\Temp\784.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\784.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\519.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\519.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\855.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\855.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\642.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\642.#.exe
        8⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\447.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\447.#.exe
        9⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\124.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\124.#.exe
        10⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\479.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\479.#.exe
        11⤵
        
        PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.exe$

Path C:\Program Files\Google\Chrome\Application\chrome.exe$
Size 4.3MB
SHA256 2e7ed626af5837e0ac656a5d153b20e26637e59446ef63604f883793b24a3d8f
MD5 92cb288c435d1fee038b228749197d1d
SHA1 8588c659d11c62c0b492bac72a7e92aa4aa97a69
SHA512 2a8be915c8fe1f217e91085a11166d7cd847444b636391aa6c12cf7eb5ad920b8e88a5e59ac066cba9eda5d876a872768a7e6c9a5c34c8ce55e1fd9aadf7dc24
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciiCFwlYvoGxUSJpXPa:HmRIDQciiDsRXPa
MD5 SHA1 SHA512 SSDEEP

Submit Download

pack200.exe$

Path C:\Program Files\Java\jre-1.8\bin\pack200.exe$
Size 4.2MB
SHA256 3e7f75ebcd1ee02bacefa21f7afec1090e248719a5c63f11e19fc4b2e2f11424
MD5 e3c2d600bba99b5eef99e8865cacede3
SHA1 8b99b65801b684fc232876a5cbedc481de33f768
SHA512 96c67b6accb4ef6d775b6bb0080a7d686a45021c44d19ad9374af7ddff8fb0a33960ba95f2256f4a920bf9ded21d2864c1d14ea5df7ca571c9c9415c8cd423ba
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciiCFwlYvoGxUSJpXPy:HmRIDQciiDsRXPy
MD5 SHA1 SHA512 SSDEEP

Submit Download

GRAPH.EXE$

Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$
Size 4.7MB
SHA256 a6c8963299ecd4da886c5e8d2120ee6cedafd6175fcf842f3edcea678ae66eac
MD5 574920486ef39b855dcd4c00f4018d2e
SHA1 ab525b8534b2533499c87fa42b6c643ccf9319cc
SHA512 63c70ff2d15e7cb97771408b8f6a1e77b8a8567c27b031c2c79889bd70b3beda0179f509e4d3b0c659496f323e82dba677ef94c4d52d16cd96f819cc3cf5579c
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciiCFwlYvoGxUSJpXP14dcgWWMi:HmRIDQciiDsRXP10QA
MD5 SHA1 SHA512 SSDEEP

Submit Download

275.#.exe

Path C:\Users\Admin\AppData\Local\Temp\275.#.exe
Size 4.2MB
SHA256 932bc4419815dfc770e7b59a02eb42226d81ba10c43c5793a7d69780cf5756c9
MD5 9dcf99215e5c296c31be8fea3fdeba9e
SHA1 e77ceab18994c57377db68130201906d8ad6628f
SHA512 fdae131add4a2b79ca0e0a0ebbaa67d5918ee2d4a30431250cf5044d268bc1054414a3d9c24172a3f61b040658363948b99fa7d1179fba285efceff364b7d4d6
SSDEEP 49152:Hmg/4MnYYJ2ZhqSGLHkJEMciiCFwlYvoGxUSJpXP:HmRIDQciiDsRXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads