a34c48379d6f25dfc57241d716fd9be7905936f4c439e8d9afc54026684cc09d

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35d5233b9892165644985f2d6050e399_JaffaCakes118.exe
Size

560KB
MD5

35d5233b9892165644985f2d6050e399
SHA1

4966f014963214dcd3c4305114184bc95acd7ca8
SHA256

a34c48379d6f25dfc57241d716fd9be7905936f4c439e8d9afc54026684cc09d
SHA512

322ea64736643858dbdec94ff290134d9ca7e5c28874954087bdefa091ef32359c775f192c1e78704439faeb0b942c32ac11b93865aa576960bc94d9ea35bfa5
SSDEEP

12288:ROPJE8xZG9xbFWyIDGhIEGpzK6FSkFvNAeF0CxYgdbc:ROPRx0DFWyDW5pzvyenYEc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	wdfmgr.ra-

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	wdfmgr.ra-

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Messenger\wdfmgr.ra-	35d5233b9892165644985f2d6050e399_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Messenger\wdfmgr.ra-	35d5233b9892165644985f2d6050e399_JaffaCakes118.exe

Modifies data under HKEY_USERS 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	wdfmgr.ra-
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wdfmgr.ra-
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wdfmgr.ra-
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-bd-c4-f2-4d-db\WpadDecisionTime = c0b591eff4d2da01	wdfmgr.ra-
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-bd-c4-f2-4d-db\WpadDecisionTime = 0031cc44f5d2da01	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	wdfmgr.ra-
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-bd-c4-f2-4d-db\WpadDecision = "0"	wdfmgr.ra-
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wdfmgr.ra-
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E0309E87-BB2F-4772-AE37-0E0BE87FD24C}	wdfmgr.ra-
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E0309E87-BB2F-4772-AE37-0E0BE87FD24C}\WpadNetworkName = "Network 3"	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-bd-c4-f2-4d-db	wdfmgr.ra-
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E0309E87-BB2F-4772-AE37-0E0BE87FD24C}\WpadDecisionReason = "1"	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E0309E87-BB2F-4772-AE37-0E0BE87FD24C}\12-bd-c4-f2-4d-db	wdfmgr.ra-
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	wdfmgr.ra-
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wdfmgr.ra-
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wdfmgr.ra-
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wdfmgr.ra-
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E0309E87-BB2F-4772-AE37-0E0BE87FD24C}\WpadDecision = "0"	wdfmgr.ra-
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E0309E87-BB2F-4772-AE37-0E0BE87FD24C}\WpadDecisionTime = c0b591eff4d2da01	wdfmgr.ra-
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-bd-c4-f2-4d-db\WpadDetectedUrl	wdfmgr.ra-
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E0309E87-BB2F-4772-AE37-0E0BE87FD24C}\WpadDecisionTime = 0031cc44f5d2da01	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\System	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wdfmgr.ra-
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wdfmgr.ra-
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wdfmgr.ra-
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	wdfmgr.ra-
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-bd-c4-f2-4d-db\WpadDecisionReason = "1"	wdfmgr.ra-
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wdfmgr.ra-

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	35d5233b9892165644985f2d6050e399_JaffaCakes118.exe
Token: SeDebugPrivilege	2844	wdfmgr.ra-

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	wdfmgr.ra-

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2740	2844	wdfmgr.ra-	31
PID 2844 wrote to memory of 2740	2844	wdfmgr.ra-	31
PID 2844 wrote to memory of 2740	2844	wdfmgr.ra-	31
PID 2844 wrote to memory of 2740	2844	wdfmgr.ra-	31

C:\Users\Admin\AppData\Local\Temp\35d5233b9892165644985f2d6050e399_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35d5233b9892165644985f2d6050e399_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Program Files (x86)\Messenger\wdfmgr.ra-
"C:\Program Files (x86)\Messenger\wdfmgr.ra-"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Messenger\wdfmgr.ra-

Filesize
560KB

MD5
35d5233b9892165644985f2d6050e399

SHA1
4966f014963214dcd3c4305114184bc95acd7ca8

SHA256
a34c48379d6f25dfc57241d716fd9be7905936f4c439e8d9afc54026684cc09d

SHA512
322ea64736643858dbdec94ff290134d9ca7e5c28874954087bdefa091ef32359c775f192c1e78704439faeb0b942c32ac11b93865aa576960bc94d9ea35bfa5

Download Submit
memory/2176-19-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-18-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-0-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2176-7-0x0000000003130000-0x00000000031C8000-memory.dmp

Filesize
608KB

Download
memory/2176-6-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/2176-5-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2176-4-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/2176-29-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-33-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-32-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-31-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-30-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-28-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-27-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-26-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-25-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-24-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-2-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2176-22-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-21-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x0000000000320000-0x000000000037A000-memory.dmp

Filesize
360KB

Download
memory/2176-20-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-23-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-17-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-16-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-15-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-14-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-13-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-12-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-11-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-10-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-9-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-8-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/2176-36-0x0000000003130000-0x0000000003170000-memory.dmp

Filesize
256KB

Download
memory/2176-37-0x0000000003130000-0x0000000003170000-memory.dmp

Filesize
256KB

Download
memory/2176-38-0x0000000003130000-0x0000000003170000-memory.dmp

Filesize
256KB

Download
memory/2176-39-0x0000000003130000-0x0000000003170000-memory.dmp

Filesize
256KB

Download
memory/2176-41-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2176-40-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2176-3-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2176-46-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2844-43-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2844-47-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download