8fdc3181c3af927fdeeb75e58678913f4a00649e47b7a657a913a1b86c07bcf8

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe
Size

633KB
MD5

17e3836682ffb0913459ece7c3f0786d
SHA1

bd67d4a7cecb335c35dcd68136dc6412d13a344b
SHA256

8fdc3181c3af927fdeeb75e58678913f4a00649e47b7a657a913a1b86c07bcf8
SHA512

ab0c3e5c341f4f35056b4ee2ef8368041a0948a680a3df51f03c4d37e223ee6e3ea5d81109e7473714b47aab5ef4240c2004ed836fc93b4a8058c9f3b2c8738e
SSDEEP

12288:O6ZMgk8+gdxsHL1CUSDF3Z4mxxWDqVTVOC7bs:b2qxsr8DQmX1VTz7bs

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2676	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	Internet Explorer.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Internet Explorer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Internet Explorer.exe	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe
File opened for modification	C:\Windows\Internet Explorer.exe	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Internet Explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57956499-CB62-440B-A7E0-7A8A5637D329}\WpadDecision = "0"	Internet Explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Internet Explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57956499-CB62-440B-A7E0-7A8A5637D329}\WpadDecisionTime = c0d888afe8c8da01	Internet Explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Internet Explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-02-74-56-ff-ee\WpadDetectedUrl	Internet Explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Internet Explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0182000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Internet Explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57956499-CB62-440B-A7E0-7A8A5637D329}	Internet Explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57956499-CB62-440B-A7E0-7A8A5637D329}\WpadDecisionTime = 8008167ee8c8da01	Internet Explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Internet Explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Internet Explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Internet Explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57956499-CB62-440B-A7E0-7A8A5637D329}\22-02-74-56-ff-ee	Internet Explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-02-74-56-ff-ee\WpadDecisionTime = 8008167ee8c8da01	Internet Explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-02-74-56-ff-ee\WpadDecision = "0"	Internet Explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Internet Explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Internet Explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Internet Explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Internet Explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-02-74-56-ff-ee\WpadDecisionReason = "1"	Internet Explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Internet Explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-02-74-56-ff-ee\WpadDecisionTime = c0d888afe8c8da01	Internet Explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Internet Explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57956499-CB62-440B-A7E0-7A8A5637D329}\WpadNetworkName = "Network 3"	Internet Explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-02-74-56-ff-ee	Internet Explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0182000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Internet Explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{57956499-CB62-440B-A7E0-7A8A5637D329}\WpadDecisionReason = "1"	Internet Explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe
Token: SeDebugPrivilege	2420	Internet Explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	Internet Explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2676	2480	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2676	2480	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2676	2480	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2676	2480	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2676	2480	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2676	2480	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2676	2480	17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2704	2420	Internet Explorer.exe	29
PID 2420 wrote to memory of 2704	2420	Internet Explorer.exe	29
PID 2420 wrote to memory of 2704	2420	Internet Explorer.exe	29
PID 2420 wrote to memory of 2704	2420	Internet Explorer.exe	29

C:\Users\Admin\AppData\Local\Temp\17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17e3836682ffb0913459ece7c3f0786d_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:2676

C:\Windows\Internet Explorer.exe
"C:\Windows\Internet Explorer.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Internet Explorer.exe

Filesize
633KB

MD5
17e3836682ffb0913459ece7c3f0786d

SHA1
bd67d4a7cecb335c35dcd68136dc6412d13a344b

SHA256
8fdc3181c3af927fdeeb75e58678913f4a00649e47b7a657a913a1b86c07bcf8

SHA512
ab0c3e5c341f4f35056b4ee2ef8368041a0948a680a3df51f03c4d37e223ee6e3ea5d81109e7473714b47aab5ef4240c2004ed836fc93b4a8058c9f3b2c8738e

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
3b4163af271f2f3c7c7c7ea3b5834210

SHA1
8a58b0ca94524dc1610e2debb97ba9b164e18e36

SHA256
5cda881c63bee4ac526e4fb2490dd07575ae983cd6a43f4976a83182d0841286

SHA512
f4d0fbe33183f4b66997228f9ff73d17f7d1a0955c8834357317e99a18a47987e88fe2c7a8595cd2e790a28906cfbf93d4e68ec383f96410bd717c8b669abd93

Download Submit
memory/2420-42-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2420-39-0x0000000000580000-0x00000000005D4000-memory.dmp

Filesize
336KB

Download
memory/2420-37-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2420-24-0x0000000000580000-0x00000000005D4000-memory.dmp

Filesize
336KB

Download
memory/2420-23-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2480-18-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/2480-4-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2480-16-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/2480-15-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2480-14-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2480-13-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/2480-12-0x0000000003280000-0x0000000003283000-memory.dmp

Filesize
12KB

Download
memory/2480-8-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2480-7-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2480-6-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2480-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2480-17-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/2480-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2480-0-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2480-19-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2480-9-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/2480-10-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2480-35-0x0000000000300000-0x0000000000354000-memory.dmp

Filesize
336KB

Download
memory/2480-34-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2480-11-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2480-2-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/2480-1-0x0000000000300000-0x0000000000354000-memory.dmp

Filesize
336KB

Download