4ea8de3128a42108f14519c9a24221bd212e6893e1646b05723c4717ac3e6fc4

Analysis

max time kernel
141s
max time network
138s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe
Size

543KB
MD5

2cec946711c83f10cd19da625fe9b29b
SHA1

5adda6c883a251bb444ba0cc9aafa4998e10e00f
SHA256

4ea8de3128a42108f14519c9a24221bd212e6893e1646b05723c4717ac3e6fc4
SHA512

cd784186cf158a1cb7f176316939f2aee9d2bbfb293f473dcfa354a86c46cfad90e6c7d58d585b93d31b9e94e945cac92035a5e09ce4942c8600bc69d02cd644
SSDEEP

12288:nOI2YpeqiR9mDny7aD44g+QF8GlF3Z4mxxoLeP6MzEUkdjqo:B2Ypl09q0aD44+QmXoCyq2Rqo

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
640	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2092	muqiu

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	muqiu

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\muqiu	2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe
File opened for modification	C:\Windows\muqiu	2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe
File created	C:\Windows\Delete.bat	2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe

Modifies data under HKEY_USERS 37 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	muqiu
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8\WpadDecisionTime = 10cf179192d1da01	muqiu
Key created	\REGISTRY\USER\.DEFAULT\System	muqiu
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	muqiu
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	muqiu
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\WpadDecisionReason = "1"	muqiu
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8\WpadDetectedUrl	muqiu
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\WpadDecisionTime = 10cf179192d1da01	muqiu
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	muqiu
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	muqiu
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	muqiu
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\WpadDecision = "0"	muqiu
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\9a-83-8c-be-90-b8	muqiu
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8\WpadDecisionReason = "1"	muqiu
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	muqiu
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	muqiu
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	muqiu
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	muqiu
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\WpadNetworkName = "Network 2"	muqiu
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	muqiu
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	muqiu
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	muqiu
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	muqiu
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	muqiu
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	muqiu
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8\WpadDecisionTime = 501da46792d1da01	muqiu
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	muqiu
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}	muqiu
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8	muqiu
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8\WpadDecision = "0"	muqiu
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	muqiu
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	muqiu
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\WpadDecisionTime = 501da46792d1da01	muqiu
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	muqiu
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	muqiu
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	muqiu
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	muqiu

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	muqiu

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2252	2092	muqiu	31
PID 2092 wrote to memory of 2252	2092	muqiu	31
PID 2092 wrote to memory of 2252	2092	muqiu	31
PID 2092 wrote to memory of 2252	2092	muqiu	31
PID 1572 wrote to memory of 640	1572	2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe	32
PID 1572 wrote to memory of 640	1572	2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe	32
PID 1572 wrote to memory of 640	1572	2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe	32
PID 1572 wrote to memory of 640	1572	2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bat
  2⤵
  - Deletes itself
  PID:640

C:\Windows\muqiu
C:\Windows\muqiu
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
214B

MD5
143874551bc96c84943f98d4000e5f00

SHA1
1361434eaeec59d8e0d423f6cc9b5031c955afda

SHA256
61a815c30cc82f0400d9c52f79b194e5def34136bc83538a1cde7399bd082d79

SHA512
fa9fa729b6f3d2f112fe709070d4fd4d364eaca54f86cab09b99e04d3f07df85483e5f3f830becc48e255f13d4a9b68949a97d6c78d8df92382b8fa92b4c357b

Download Submit
C:\Windows\muqiu

Filesize
543KB

MD5
2cec946711c83f10cd19da625fe9b29b

SHA1
5adda6c883a251bb444ba0cc9aafa4998e10e00f

SHA256
4ea8de3128a42108f14519c9a24221bd212e6893e1646b05723c4717ac3e6fc4

SHA512
cd784186cf158a1cb7f176316939f2aee9d2bbfb293f473dcfa354a86c46cfad90e6c7d58d585b93d31b9e94e945cac92035a5e09ce4942c8600bc69d02cd644

Download Submit
memory/1572-24-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1572-10-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/1572-8-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/1572-7-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/1572-22-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-5-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1572-4-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/1572-3-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/1572-2-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1572-1-0x0000000000390000-0x00000000003E4000-memory.dmp

Filesize
336KB

Download
memory/1572-13-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-20-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-9-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/1572-0-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1572-6-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1572-21-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-19-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-18-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-17-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-16-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-15-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-14-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-12-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-23-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1572-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1572-11-0x0000000003250000-0x00000000032E8000-memory.dmp

Filesize
608KB

Download
memory/2092-28-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2092-39-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download