53e69e5051a7bb297bf87d8a77a41aaaa5b90cc25ff8426a3a6827b696e1223c

Analysis

max time kernel
137s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3856c7188c605bde3872187ac8c3a4c_JaffaCakes118.exe
Size 2.2MB
Sample240613-ct4pcavcpq
SHA256 53e69e5051a7bb297bf87d8a77a41aaaa5b90cc25ff8426a3a6827b696e1223c
MD5 a3856c7188c605bde3872187ac8c3a4c
SHA1 1bcc45bf0e542d2016a0b86b7a6a0978d97044e3
SHA512 0de001d6cd24d72f062380b06ef9a56b9a68477fec7d91850b32a8c25904edc32501c6fb6160342c711b1bdfeaab02f572b6234741cd9064038b656973e77f48
SSDEEP 24576:h1OYdaODqU2Uzf5cilCfBJytWSb/DBXEZc78KU88Smhrazcp:h1Os5qBI5cilCfab7vuhryw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	tvffZOjm1lF3hoL.exe

Executes dropped EXE 2 IoCs

pid	Process
3904	tvffZOjm1lF3hoL.exe
1280	tvffZOjm1lF3hoL.exe

Loads dropped DLL 1 IoCs

pid	Process
1280	tvffZOjm1lF3hoL.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\.aHTML\OpenWithProgids	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\SystemFileAssociations\.aHTML\shell\Edit\command	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\SystemFileAssociations\.aHTML\shell\Edit\ddeexec	tvffZOjm1lF3hoL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\SystemFileAssociations\.aHTML\shell\Edit\command\ = "Notepad.exe"	tvffZOjm1lF3hoL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\__aHTML\shell\Edit\command\ = "Notepad.exe"	tvffZOjm1lF3hoL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\SystemFileAssociations\.aHTML\shell\Edit\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\CKLJPV.tmp\\tvffZOjm1lF3hoL.exe\" target \".\\\" bits downExt"	tvffZOjm1lF3hoL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\__aHTML\shell\Edit\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\CKLJPV.tmp\\tvffZOjm1lF3hoL.exe\" target \".\\\" bits downExt"	tvffZOjm1lF3hoL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\.aHTML\OpenWithProgids\__aHTML	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\SystemFileAssociations	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\SystemFileAssociations\.aHTML\shell	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\.aHTML	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\SystemFileAssociations\.aHTML	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\SystemFileAssociations\.aHTML\shell\Edit	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\__aHTML\shell	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\__aHTML\shell\Edit\command	tvffZOjm1lF3hoL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\.aHTML\ = "__aHTML"	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\__aHTML	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\__aHTML\shell\Edit	tvffZOjm1lF3hoL.exe
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\__aHTML\shell\Edit\ddeexec	tvffZOjm1lF3hoL.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	tvffZOjm1lF3hoL.exe
1280	tvffZOjm1lF3hoL.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	tvffZOjm1lF3hoL.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3904	1288	a3856c7188c605bde3872187ac8c3a4c_JaffaCakes118.exe	89
PID 1288 wrote to memory of 3904	1288	a3856c7188c605bde3872187ac8c3a4c_JaffaCakes118.exe	89
PID 1288 wrote to memory of 3904	1288	a3856c7188c605bde3872187ac8c3a4c_JaffaCakes118.exe	89
PID 3904 wrote to memory of 1280	3904	tvffZOjm1lF3hoL.exe	90
PID 3904 wrote to memory of 1280	3904	tvffZOjm1lF3hoL.exe	90
PID 3904 wrote to memory of 1280	3904	tvffZOjm1lF3hoL.exe	90
PID 1280 wrote to memory of 2008	1280	tvffZOjm1lF3hoL.exe	91
PID 1280 wrote to memory of 2008	1280	tvffZOjm1lF3hoL.exe	91
PID 1280 wrote to memory of 2008	1280	tvffZOjm1lF3hoL.exe	91

C:\Users\Admin\AppData\Local\Temp\a3856c7188c605bde3872187ac8c3a4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3856c7188c605bde3872187ac8c3a4c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\tvffZOjm1lF3hoL.exe
  .\tvffZOjm1lF3hoL.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Users\Admin\AppData\Local\Temp\CKLJPV.tmp\tvffZOjm1lF3hoL.exe
    "C:\Users\Admin\AppData\Local\Temp\CKLJPV.tmp\tvffZOjm1lF3hoL.exe" target ".\" bits downExt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /u /s ".\\FxBFefNa51mNZu.x64.dll"
      4⤵
      PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4180,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:8
1⤵
PID:416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FxBFefNa51mNZu.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\FxBFefNa51mNZu.dll
Size 863KB
SHA256 2f77fd9b3fab80f237cebce0857871774a0ae568d65995a2d0e522db9f654b3f
MD5 18943070dfa2becc83a243c5d6d9c223
SHA1 75baab95b9e4544f0858f4ab1b024eb1051c2e74
SHA512 d2781bedc91f16d78323b61c7f9c1f9657e10a3c1ae473b37e4e0b1e5186586373d1cd4f9abe70a5f20a11a274b502e9fa28c8115f5b1fe73e5a4be539829b96
SSDEEP 12288:6iMsCmaJsGUwaEFPJyr1ZS/bl+RWPS0mEMD:6ilCfBJytWSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

FxBFefNa51mNZu.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\FxBFefNa51mNZu.tlb
Size 5KB
SHA256 495c35bf29cd1c6e4a736db79e87203b6fd0c1345343dab958e5d9a4b087754c
MD5 1ca45b386c7b01e1bd45ef4e291d3f70
SHA1 dcabb955bc45b182231459d7e64cba59592c907e
SHA512 87dc04954e21af239f1cd8a300d7ea34c0de9580598080df8e2e75d347ad0232770b37d648db772f5d854a553f395a1fe9c010071ee76024f64ed819371fe752
SSDEEP 96:4lqqY3Oxw6AnCYiie3TJLAiePZj/dvuPUKOptYm:9+j3TJ0iePZ9dZptYm
MD5 SHA1 SHA512 SSDEEP

Submit Download

FxBFefNa51mNZu.x64.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\FxBFefNa51mNZu.x64.dll
Size 945KB
SHA256 27bc2b6c48f4ed824d11dc0e57222f9e4e6d22de68052839fde68c072e642859
MD5 026284fc553ecffe0790e86310d0f454
SHA1 f5b59816d44fb0b37fd3e243ad595459fcf304c0
SHA512 4e63f2acbca26d3fe3fd215fdd0079402d48e84ce762a025ee03731df2ae7af22b71dffc9d2915a0ec273a534660e7f2771208d5b404ea124880d76501759fb5
SSDEEP 12288:opqyvx00kTzJEWcFDsvXWthTWeBV1EZcmM8KUbtm8Sf+hruDvzc:yDBXEZc78KU88Smhrazc
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
MD5 df13f711e20e9c80171846d4f2f7ae06
SHA1 56d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA512 6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\[email protected]\chrome.manifest
Size 35B
SHA256 d924c441de61f359f445eb6427c3160b68ab348f2e0abbcbf62edf730cdddc68
MD5 1f7b204643e801e917df2cb613bd0d82
SHA1 f50e79277785cc3dc23411295eb877d5364f8c79
SHA512 515c1f36298dd0e392f67635b28280b14536749a621f5eb80dc7cc895b3056208be736006438e352f47723777a4f6e43f245f4074454d5e27597f8fd9b01aef8
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\[email protected]\content\bg.js
Size 8KB
SHA256 d8e9c7f3019bf30e2b68015b23858fb60554f94134af7dabde7e09cfd2701c2d
MD5 0b0799e2913638409fb4cdf754d81bcd
SHA1 f9c0fec760cf813d741a14e9efd0ee3451347075
SHA512 a732147c51b61b316ba6ca2314492b6df1a7178e7edaab708501fc21c065f4765faf2d0b46c13dd05deec066a4d6e74e9337e8323bdc49edb95ad335c194ca51
SSDEEP 96:Lc7CJJ30OMs0NxwTsnv4/jVE6zp+e56l8kx00N3zYZcD90jh3zYZcl/3zYZcI0iv:Lc7gInv4/WE/0riiQKilkivVqkY7DLOW
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\[email protected]\install.rdf
Size 606B
SHA256 c95a9cb6f465caab3bbb13c5eb8a32b64c7ee63e3c4a7101c94043f836250cee
MD5 0fe11af61c6284996014f48529930b3b
SHA1 4b164c5811d1d324922d44e8e4685dd30450bd3c
SHA512 75d6159fbf057dfe61d7d22766052d8c69567df2b4d6cfe0d483558a1d380442c149cde94fa6a981b7e9b13a679d1284f5acec3cd0945bfe6eb1098cb636647c
MD5 SHA1 SHA512

Submit Download

A0X3TMH.js

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\dkjificllfanelnlnpmldndggaloehko\A0X3TMH.js
Size 6KB
SHA256 5b2bebe1d3b0e037909515adf607e7e083ac9bae624b6f6c8d98fc27e86bd155
MD5 d5081af7329021b32959edc9973c15df
SHA1 c3fa7d631d89f2e7850a3ba82ce0a6cc3e99d907
SHA512 9b52c3dbc93046cfcb5e55e270df0fef26b8ae8c075aae1884d059d399f1a986f0cd1dbb58dd5047b5c1d23bd6ff6635a0ba5420a59ab0fe76901cccef70b01b
SSDEEP 96:93c7HJJ0vOai0NxOT5fUA8kx00N3zYZcD90jh3zYZcl/3zYZcI0i0E0v0IWN0wv9:93c7xVfUAriiQKilkiH7qpIY9CLW
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\dkjificllfanelnlnpmldndggaloehko\background.html
Size 144B
SHA256 e5db4519724515dde333319c4c3945c60d81f326168d31fa32da6fea302b9b87
MD5 8facf6b87ed4233e3bd74f2a3519e0bc
SHA1 d95da4f71b899812b440775e43ddc5f56ddbfeea
SHA512 1294b3aa57ab9bc8ac842233b902e3445e88e58094d6db36bd8197a82ad8160b1186eaed01a80f3c08d79d74f40085797376e2bf51491006283c05cd976ad0f9
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\dkjificllfanelnlnpmldndggaloehko\content.js
Size 144B
SHA256 332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
MD5 fca19198fd8af21016a8b1dec7980002
SHA1 fd01a47d14004e17a625efe66cc46a06c786cf40
SHA512 60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\dkjificllfanelnlnpmldndggaloehko\lsdb.js
Size 531B
SHA256 ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
MD5 36d98318ab2b3b2585a30984db328afb
SHA1 f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA512 6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\dkjificllfanelnlnpmldndggaloehko\manifest.json
Size 507B
SHA256 5cf15bb7e879d115dc5d53e3a3bec73aa8f72a2522439c2b41e85d309989f1eb
MD5 3c39da7028a514a3ee884b745070076f
SHA1 84f932adbcebebf706fa6edf0ab676414493dd46
SHA512 fc22f5d63b5591d4fed49c5661c64ffd57062dd314642c0e4d7af2682c1d21c6b11833151d2d6ae7515c714b3f1a6e77ea77fa50672682d1cdff34dcf79ed8e0
MD5 SHA1 SHA512

Submit Download

tvffZOjm1lF3hoL.dat

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\tvffZOjm1lF3hoL.dat
Size 14KB
SHA256 3c48e093739003466be3adbabd539513a45d1737f5ef2410faa2563324a54ba5
MD5 a159bd66eeef9c2f981fab9bfe5807c9
SHA1 f381eac0046f2abd7a973699b3f1db567cafd12e
SHA512 b05150a1f5e3d1054b22e81b39d8f48e6465d6abe253842e762f26ee2de747b7dd4bb4dfbca580853f44ae1f9698d7fa6fa74755f969bc3254011de6cc88f873
SSDEEP 192:d+kfc6Dul9D8Od8YeDvoZ7N1bNUnoHmLYXgcUIbnl5WQDL8eRG3Y+6dOahm:3v8oOdyvUv0LCxL8r3MAP
MD5 SHA1 SHA512 SSDEEP

Submit Download

tvffZOjm1lF3hoL.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSF2FB.tmp\tvffZOjm1lF3hoL.exe
Size 218KB
SHA256 7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4
MD5 9f6c52eec607111136cd222b02bf0530
SHA1 57f3815d0942e3b0a9bef621a7b4971f55fc74d7
SHA512 6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54
SSDEEP 3072:L8sWeQCnJX7YN7Fq/8xnOjbC27isT+1BYfhmqAZ7TnUA5:L8sWeQyKFqU1aC2UumqAZ77UA5
MD5 SHA1 SHA512 SSDEEP

Submit Download