f312c93d3b5a283804dcad78200d7f1e10d63bec4f5eb0adb495fd0e2c96eac3

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe
Size

745KB
MD5

00513ae9f8f4efe501fa7aa78d635486
SHA1

ae431161a2430eba097a29185a0e4728c1caac5b
SHA256

f312c93d3b5a283804dcad78200d7f1e10d63bec4f5eb0adb495fd0e2c96eac3
SHA512

d9c0fb6a517edfdca8cc1aa0017bf2d5f015090fa260f255b38d458ef2a5022de71f5c0fecbd19946a0ccc9b6674e9e8aa5cf87d122b0185bd598c2cced7b083
SSDEEP

12288:QVTA3RzMTHj+3bppRfWZUPz3NsAHlo+BTUIGc8kiu0cv6oEl3S+sn5Wbg6IP:Q2RzMTD+NpRfWZUP7f7BTUIGc8ki5cvX

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2632	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2056	0xday_huigz

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	0xday_huigz

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\0xday_huigz	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe
File opened for modification	C:\Windows\0xday_huigz	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	0xday_huigz
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	0xday_huigz
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	0xday_huigz
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	0xday_huigz
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-25-47-96-8f-13\WpadDetectedUrl	0xday_huigz
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	0xday_huigz
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}	0xday_huigz
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-25-47-96-8f-13	0xday_huigz
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-25-47-96-8f-13\WpadDecisionReason = "1"	0xday_huigz
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-25-47-96-8f-13\WpadDecisionTime = 705d4e4686c2da01	0xday_huigz
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-25-47-96-8f-13\WpadDecision = "0"	0xday_huigz
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	0xday_huigz
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\WpadDecision = "0"	0xday_huigz
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\8e-25-47-96-8f-13	0xday_huigz
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-25-47-96-8f-13\WpadDecisionTime = b074b27b86c2da01	0xday_huigz
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	0xday_huigz
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	0xday_huigz
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\WpadDecisionReason = "1"	0xday_huigz
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	0xday_huigz
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\WpadDecisionTime = b074b27b86c2da01	0xday_huigz
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	0xday_huigz
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	0xday_huigz
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	0xday_huigz
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	0xday_huigz
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	0xday_huigz
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\WpadDecisionTime = 705d4e4686c2da01	0xday_huigz
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\WpadNetworkName = "Network 3"	0xday_huigz
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	0xday_huigz

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	332	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe
Token: SeDebugPrivilege	2056	0xday_huigz

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	0xday_huigz

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 2632	332	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe	29
PID 332 wrote to memory of 2632	332	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe	29
PID 332 wrote to memory of 2632	332	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe	29
PID 332 wrote to memory of 2632	332	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe	29
PID 332 wrote to memory of 2632	332	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe	29
PID 332 wrote to memory of 2632	332	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe	29
PID 332 wrote to memory of 2632	332	00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00513ae9f8f4efe501fa7aa78d635486_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:2632

C:\Windows\0xday_huigz
C:\Windows\0xday_huigz
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\0xday_huigz

Filesize
745KB

MD5
00513ae9f8f4efe501fa7aa78d635486

SHA1
ae431161a2430eba097a29185a0e4728c1caac5b

SHA256
f312c93d3b5a283804dcad78200d7f1e10d63bec4f5eb0adb495fd0e2c96eac3

SHA512
d9c0fb6a517edfdca8cc1aa0017bf2d5f015090fa260f255b38d458ef2a5022de71f5c0fecbd19946a0ccc9b6674e9e8aa5cf87d122b0185bd598c2cced7b083

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
706aac15fefa2141598de463d8ff415a

SHA1
d1211565a6045c513570e08d39a74471ab986b0d

SHA256
5deef23d0564046075458fd652ebbe6c9492ab33dd21415a921034e4302aa6e0

SHA512
7c991ea48e4364daf46749c8dbfc19dfd597b50b7c61d2bc1f1b4824a2f6695c361bee236c841698f917fdf86a1162104bba7a564c45e1b4a76e6ee8f8a81aef

Download Submit
memory/332-0-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/332-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/332-14-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/2056-6-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2056-5-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/2056-16-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/2056-17-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download