Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 03:19
Static task
static1
Behavioral task
behavioral1
Sample
a7d39878eb441e90307893a5e459cba6_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a7d39878eb441e90307893a5e459cba6_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
a7d39878eb441e90307893a5e459cba6_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a7d39878eb441e90307893a5e459cba6
-
SHA1
66ba2b76becf86cef71a3a5750dc079440bc9779
-
SHA256
4d6569c2f7bf724bbbcf815bfb92ba0d6b5c817d1650cfc0a2e9634db3bd14e9
-
SHA512
52b3f9b472b45a0515597923b26338facfd2f64cf1dc63a7c329d4c85c58df72bc3a9807065be76fb23cdee54be20d6d79e26f9c739a6484e55489950c0e219f
-
SSDEEP
24576:h1OYdaOkqU2Uzf5TilCfBJyAWSODBXEZc78KU88SXhrrWzcN:h1OsKqBI5TilCfJIvfhrSo
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1592 1TwXli6DlRNJrA2.exe 2532 1TwXli6DlRNJrA2.exe -
Loads dropped DLL 4 IoCs
pid Process 2392 a7d39878eb441e90307893a5e459cba6_JaffaCakes118.exe 1592 1TwXli6DlRNJrA2.exe 1592 1TwXli6DlRNJrA2.exe 2532 1TwXli6DlRNJrA2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\SystemFileAssociations\.aHTML\shell 1TwXli6DlRNJrA2.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\SystemFileAssociations\.aHTML\shell\Edit\command\ = "Notepad.exe" 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\__aHTML 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\SystemFileAssociations\.aHTML\shell\Edit\ddeexec 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\__aHTML\shell\Edit 1TwXli6DlRNJrA2.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\SystemFileAssociations\.aHTML\shell\Edit\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RCAKNZ.tmp\\1TwXli6DlRNJrA2.exe\" target \".\\\" bits downExt" 1TwXli6DlRNJrA2.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\__aHTML\shell\Edit\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RCAKNZ.tmp\\1TwXli6DlRNJrA2.exe\" target \".\\\" bits downExt" 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\SystemFileAssociations 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\SystemFileAssociations\.aHTML 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\SystemFileAssociations\.aHTML\shell\Edit 1TwXli6DlRNJrA2.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.aHTML\OpenWithProgids\__aHTML 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\SystemFileAssociations\.aHTML\shell\Edit\command 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\__aHTML\shell\Edit\command 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\__aHTML\shell\Edit\ddeexec 1TwXli6DlRNJrA2.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\__aHTML\shell\Edit\command\ = "Notepad.exe" 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.aHTML 1TwXli6DlRNJrA2.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.aHTML\ = "__aHTML" 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.aHTML\OpenWithProgids 1TwXli6DlRNJrA2.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\__aHTML\shell 1TwXli6DlRNJrA2.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2532 1TwXli6DlRNJrA2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2532 1TwXli6DlRNJrA2.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2392 wrote to memory of 1592 2392 a7d39878eb441e90307893a5e459cba6_JaffaCakes118.exe 28 PID 2392 wrote to memory of 1592 2392 a7d39878eb441e90307893a5e459cba6_JaffaCakes118.exe 28 PID 2392 wrote to memory of 1592 2392 a7d39878eb441e90307893a5e459cba6_JaffaCakes118.exe 28 PID 2392 wrote to memory of 1592 2392 a7d39878eb441e90307893a5e459cba6_JaffaCakes118.exe 28 PID 1592 wrote to memory of 2532 1592 1TwXli6DlRNJrA2.exe 29 PID 1592 wrote to memory of 2532 1592 1TwXli6DlRNJrA2.exe 29 PID 1592 wrote to memory of 2532 1592 1TwXli6DlRNJrA2.exe 29 PID 1592 wrote to memory of 2532 1592 1TwXli6DlRNJrA2.exe 29 PID 2532 wrote to memory of 2548 2532 1TwXli6DlRNJrA2.exe 30 PID 2532 wrote to memory of 2548 2532 1TwXli6DlRNJrA2.exe 30 PID 2532 wrote to memory of 2548 2532 1TwXli6DlRNJrA2.exe 30 PID 2532 wrote to memory of 2548 2532 1TwXli6DlRNJrA2.exe 30 PID 2532 wrote to memory of 2548 2532 1TwXli6DlRNJrA2.exe 30 PID 2532 wrote to memory of 2548 2532 1TwXli6DlRNJrA2.exe 30 PID 2532 wrote to memory of 2548 2532 1TwXli6DlRNJrA2.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7d39878eb441e90307893a5e459cba6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7d39878eb441e90307893a5e459cba6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\7zS6D63.tmp\1TwXli6DlRNJrA2.exe.\1TwXli6DlRNJrA2.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\RCAKNZ.tmp\1TwXli6DlRNJrA2.exe"C:\Users\Admin\AppData\Local\Temp\RCAKNZ.tmp\1TwXli6DlRNJrA2.exe" target ".\" bits downExt3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /u /s ".\\Nh8Jj2KWoBG4Bg.x64.dll"4⤵PID:2548
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5705eb60c980f5b2b400ed7a61b797791
SHA141710e3a5c6935ac5faf645e14252def27ba7385
SHA2567f2c1d111a384556ad2cce5fca0bd9177cdcb6b7cc9dea1ba6efddeb3fb5e553
SHA512004b60ffd4e1441cb3511afa2a6f5c7d9110d0dd474cbe725b68cc88842456fa5e1ba14656d96f6dd28e555a13cc07f392c201a98a191506b8f8f2e052da02bb
-
Filesize
863KB
MD5440b206626a1c62c8bafe816fbe17453
SHA1c08963702e4678be7fc0f1bbc3b2b8f4c0e65599
SHA2567b08170197951130ae82e41682a5767934bcc20941d2b5c68245fa7848709fbc
SHA5121d5737f768902e2481070b11ce3c07489f964b990d25d668ca6ab1dfb57d325aa6f66680a0b15bfa09e2b127f159480fa6e7d6f435d129a79a8e8db7ce9436e2
-
Filesize
5KB
MD51ca45b386c7b01e1bd45ef4e291d3f70
SHA1dcabb955bc45b182231459d7e64cba59592c907e
SHA256495c35bf29cd1c6e4a736db79e87203b6fd0c1345343dab958e5d9a4b087754c
SHA51287dc04954e21af239f1cd8a300d7ea34c0de9580598080df8e2e75d347ad0232770b37d648db772f5d854a553f395a1fe9c010071ee76024f64ed819371fe752
-
Filesize
945KB
MD5bb4edcd0d1dbea879ceaf63dbbc497ff
SHA14769e78a4388ece7574a8957854af2b5471f7b87
SHA2567fbd461cbe2e3cf3109bff8331e6aa612bde6a4424c1035dcdde57babff32a97
SHA512cbfe8c360c5d710bcd3a238456f5e76e29ad0600c16fe11ce27d6e3eb4ccf33d4d47986b0d79f4e0b8554f7046756e6a313f3babf0f72e13d97527ae0900c41b
-
C:\Users\Admin\AppData\Local\Temp\7zS6D63.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS6D63.tmp\[email protected]\chrome.manifest
Filesize35B
MD5701d800cda954bfce6e81a2422a2b61a
SHA1b6775604deb79f4249929d02f83f8b646db8ee94
SHA256a26bf1acdd0144855cce6bcf5b25a91739b4c2339bfa35088c4d4ec51b610dd7
SHA512df3bcc4ab3ead21770701b34c930d5ffa8e6463efe184393082840e1e052a3573a6c004d0a4aeec807f1cff49fe7b73b497446be3ae2f75ea19b5c97268fc47c
-
C:\Users\Admin\AppData\Local\Temp\7zS6D63.tmp\[email protected]\content\bg.js
Filesize8KB
MD56a41337fbab39a2e3948b658e35bc895
SHA1e2dfca535c0c2cd04d27229e6b31d19551afc11e
SHA25606949935b21faa65756518c3a34f31edafbf08388c9e5f6f5b9463c6bf6cb7ae
SHA51266665eeb61a034eea83d0a86a712c2a2eadb2f10a8bd802c84f4c0ff12a4cfb3adfe19ad8bdc30cfbd7cd95c22888bbf942fe8a4b3a1eff46e4a095299ad6c88
-
C:\Users\Admin\AppData\Local\Temp\7zS6D63.tmp\[email protected]\install.rdf
Filesize598B
MD5e3fc886066603692fcb62525ecbd848a
SHA1541e563736d9014fcd9294a1b133ba94132f0744
SHA2564de82898bc2b196e3e76ad3c29b7ba6ddda55c45c3d0349a7d6877cbe4678bc7
SHA512fcf63986d4c89f870e68b81e332bc325a39e8a005c233c5b65d959ea406133a46a455744502a6fd51bda3f1772bac106863d57e7eb5d206a6a927e8eb2d57d39
-
Filesize
146B
MD5bd970a24cae8aeb124cc28b44642cdfe
SHA186dbde91655bb90a4ddb1ca4e1206bcb3b7a2d2f
SHA25661269972465799e7f7065257bdede81380cfd5c653e785a3ddc151ae6d46459d
SHA51207e9a1a9766d49dad8400fd9ce6055d1b0182b8cc99fe54929c57ae3084b88fa82717c5ca3d416df8fdf50fd6c35593c0425fc68e979176af470ae2eb2ac87de
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
503B
MD5947c255007d07989c8cb8adbe68aeb5d
SHA1e5963c167a2d1743d877e3e4fa427157d46938c4
SHA25646aceaf1713d8b6d9a7f0884dc41cbc0d67d5bba69f25bde680277c9b4f8a009
SHA512d44dfcf55a359bf0ea513d6405e9caa2234234f69aa87d80c0fea8d5f291b021993f187034ca7264541e61e2b7e23fef56251c54ba2363cdbaeaf1340119d63d
-
Filesize
6KB
MD54d4092bb0ca76a5996b558f85a1a1815
SHA1f863eed051fa4ccd66633edf6a32ca6ecd723d09
SHA25630bdfcf66960970fa33befbbfb2141ae551a899c336316cb927821208a1d9c87
SHA512c751c609310f9e20677ebd171dde6933d229d2c30533b4f1b73eb1ed22a7185a3420c13474794f9d644ddc355c822bd73214afe9a664bf0c7f29a4f05158c8f3
-
Filesize
218KB
MD59f6c52eec607111136cd222b02bf0530
SHA157f3815d0942e3b0a9bef621a7b4971f55fc74d7
SHA2567314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4
SHA5126760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54