5bf9031882d66caad81debb6f6753535c7a65c2ff2fbc5f44a36d31ec4935c17

Analysis

max time kernel
142s
max time network
139s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe
Size

677KB
MD5

2c3746bd1821c788879d9e524efd60f0
SHA1

5dd747eda7a3c7b7683236518362ec3e33228592
SHA256

5bf9031882d66caad81debb6f6753535c7a65c2ff2fbc5f44a36d31ec4935c17
SHA512

dd929b3a412fc956204678448d45727029993239ccc2b530178a7dbc77f4e5f23ff401d94e62041790eca42d724fe21ce77c11d7449af0c053f1a8d4a072ec8b
SSDEEP

12288:+uxdhCOTOdjY1Lo7t5TLPMxqfkr/UezQupLZAF3Z4mxxpDqVTVOCO:R7DO/v/qEkr8ezfZAQmXAVTzO

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2892	1.exe
2616	System.exe

Loads dropped DLL 3 IoCs

pid	Process
2848	2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe
2848	2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe
2892	1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	System.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System.exe	1.exe
File opened for modification	C:\Windows\System.exe	1.exe
File created	C:\Windows\uninstal.bat	1.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D4EA2A9-7DC1-4F49-85E3-39D167DB9EC4}\WpadNetworkName = "Network 3"	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-2c-2f-de-7c-6a\WpadDecisionReason = "1"	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-2c-2f-de-7c-6a\WpadDecision = "0"	System.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-2c-2f-de-7c-6a	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	System.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D4EA2A9-7DC1-4F49-85E3-39D167DB9EC4}\b6-2c-2f-de-7c-6a	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-2c-2f-de-7c-6a\WpadDecisionTime = f0b18d3669d1da01	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-2c-2f-de-7c-6a\WpadDecisionTime = 30ff306069d1da01	System.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	System.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D4EA2A9-7DC1-4F49-85E3-39D167DB9EC4}	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D4EA2A9-7DC1-4F49-85E3-39D167DB9EC4}\WpadDecision = "0"	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-2c-2f-de-7c-6a\WpadDetectedUrl	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D4EA2A9-7DC1-4F49-85E3-39D167DB9EC4}\WpadDecisionReason = "1"	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D4EA2A9-7DC1-4F49-85E3-39D167DB9EC4}\WpadDecisionTime = f0b18d3669d1da01	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1D4EA2A9-7DC1-4F49-85E3-39D167DB9EC4}\WpadDecisionTime = 30ff306069d1da01	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	1.exe
Token: SeDebugPrivilege	2616	System.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2616	System.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2892	2848	2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2892	2848	2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2892	2848	2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2892	2848	2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2892	2848	2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2892	2848	2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2892	2848	2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe	30
PID 2892 wrote to memory of 2628	2892	1.exe	32
PID 2892 wrote to memory of 2628	2892	1.exe	32
PID 2892 wrote to memory of 2628	2892	1.exe	32
PID 2892 wrote to memory of 2628	2892	1.exe	32
PID 2892 wrote to memory of 2628	2892	1.exe	32
PID 2892 wrote to memory of 2628	2892	1.exe	32
PID 2892 wrote to memory of 2628	2892	1.exe	32

C:\Users\Admin\AppData\Local\Temp\2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c3746bd1821c788879d9e524efd60f0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\uninstal.bat
    3⤵
    PID:2628

C:\Windows\System.exe
C:\Windows\System.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\uninstal.bat

Filesize
150B

MD5
38abcb0e3e0290b7fd102ede63184294

SHA1
db5ea8b475b211779aee0ceaec4e7d389195b899

SHA256
7c31d1ad068fa0fd74158b9855f4bc8ec2467875bd74e3f8272df986c51166b7

SHA512
5c52f1692419d02d50f1296251aba070a7829e63fa88fd4f9b9e15e488e4be9de69240b5fa3a721c41a644851ea28418cbb1f90492b2d57d689e051faeafdd22

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe

Filesize
772KB

MD5
76bcfbb47dd85cf5583488a297874cc3

SHA1
cc391a760880cbe069a48e57bd57b0e7badb51d4

SHA256
654329acf916ab6745e5dba574f5bca718c88d8acc69b7ac03b94ff637988db9

SHA512
c7d4581cc84393ae1f59cdea58bc0b4c01d41a74ab533f97703f36cc834478fa9383312530f90f3ba951e3e3eb024314502cef81da2b6584fdab6dabd6384488

Download Submit
memory/2616-24-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2616-30-0x0000000000400000-0x00000000004C8016-memory.dmp

Filesize
800KB

Download
memory/2616-32-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2848-0-0x0000000001000000-0x00000000010B5000-memory.dmp

Filesize
724KB

Download
memory/2848-2-0x0000000001000000-0x00000000010B5000-memory.dmp

Filesize
724KB

Download
memory/2848-1-0x0000000001062000-0x0000000001063000-memory.dmp

Filesize
4KB

Download
memory/2848-3-0x0000000001000000-0x00000000010B5000-memory.dmp

Filesize
724KB

Download
memory/2848-28-0x0000000001000000-0x00000000010B5000-memory.dmp

Filesize
724KB

Download
memory/2892-26-0x0000000000400000-0x00000000004C8016-memory.dmp

Filesize
800KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads