640831973f16a461c8f12bf980c8261440d7b9f9aeb66aeb2908e701c70ad98a

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 05:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe
Size

281KB
MD5

37df775bd2ca35ef4c8e252181812438
SHA1

7e96db2fae18fc4c592dc3ebae7ef065a45bd96f
SHA256

640831973f16a461c8f12bf980c8261440d7b9f9aeb66aeb2908e701c70ad98a
SHA512

fb24e5676dfa4c2e501ff390989f7ffd3d9f29e445052879be95f58fee13394ebb39773683b3165b05fe5f6960e3392b4f2dfee8fb02726899a702d22352a638
SSDEEP

6144:QvUTQlCjQA6XTqbU94/awxvTVTfyuw5H+Mb3P1pHQGXQDMHp:+HC0tjqkQawtRTfweK3d4DMJ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2788	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1804	systim32

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	systim32

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\systim32	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe
File opened for modification	C:\Windows\systim32	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	systim32
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{27837800-F0B7-4147-9084-6DCD7AD1DC66}\WpadNetworkName = "Network 3"	systim32
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-81-4c-97-53-96\WpadDecisionTime = 3026cb6253d3da01	systim32
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	systim32
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	systim32
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	systim32
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-81-4c-97-53-96	systim32
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-81-4c-97-53-96\WpadDecisionReason = "1"	systim32
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	systim32
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	systim32
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{27837800-F0B7-4147-9084-6DCD7AD1DC66}\WpadDecisionTime = 3026cb6253d3da01	systim32
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{27837800-F0B7-4147-9084-6DCD7AD1DC66}\WpadDecisionTime = 3000349853d3da01	systim32
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-81-4c-97-53-96\WpadDecisionTime = 3000349853d3da01	systim32
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	systim32
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	systim32
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{27837800-F0B7-4147-9084-6DCD7AD1DC66}	systim32
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	systim32
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	systim32
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	systim32
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{27837800-F0B7-4147-9084-6DCD7AD1DC66}\e2-81-4c-97-53-96	systim32
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	systim32
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{27837800-F0B7-4147-9084-6DCD7AD1DC66}\WpadDecisionReason = "1"	systim32
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	systim32
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	systim32
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	systim32
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{27837800-F0B7-4147-9084-6DCD7AD1DC66}\WpadDecision = "0"	systim32
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-81-4c-97-53-96\WpadDecision = "0"	systim32
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-81-4c-97-53-96\WpadDetectedUrl	systim32

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe
Token: SeDebugPrivilege	1804	systim32

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	systim32

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2312	1804	systim32	32
PID 1804 wrote to memory of 2312	1804	systim32	32
PID 1804 wrote to memory of 2312	1804	systim32	32
PID 1804 wrote to memory of 2312	1804	systim32	32
PID 2992 wrote to memory of 2788	2992	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe	33
PID 2992 wrote to memory of 2788	2992	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe	33
PID 2992 wrote to memory of 2788	2992	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe	33
PID 2992 wrote to memory of 2788	2992	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe	33
PID 2992 wrote to memory of 2788	2992	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe	33
PID 2992 wrote to memory of 2788	2992	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe	33
PID 2992 wrote to memory of 2788	2992	37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37df775bd2ca35ef4c8e252181812438_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:2788

C:\Windows\systim32
C:\Windows\systim32
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files\Internet Explorer\IexplOrE.ExE
  "C:\Program Files\Internet Explorer\IexplOrE.ExE"
  2⤵
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\systim32

Filesize
281KB

MD5
37df775bd2ca35ef4c8e252181812438

SHA1
7e96db2fae18fc4c592dc3ebae7ef065a45bd96f

SHA256
640831973f16a461c8f12bf980c8261440d7b9f9aeb66aeb2908e701c70ad98a

SHA512
fb24e5676dfa4c2e501ff390989f7ffd3d9f29e445052879be95f58fee13394ebb39773683b3165b05fe5f6960e3392b4f2dfee8fb02726899a702d22352a638

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
bcfd6a2d4adb3cf3fce290f8899c9b28

SHA1
6d5e001ac62392330b50f37bdef6886c27f71d07

SHA256
5fa25633a160808ce009c3c2cc5656369d20abb72f75abb1c0d0bf42f7a209da

SHA512
77c2134021b145983c017e81e1453400e3be18ed9a73016a9c8493766677074524d76d7ae1ed92f00b2c014bd0e2107204f9d092e0c855181e77bc048144ad4e

Download Submit
memory/1804-13-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1804-10-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1804-11-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1804-15-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1804-14-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1804-25-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2992-3-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2992-1-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2992-8-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2992-4-0x000000000050E000-0x000000000050F000-memory.dmp

Filesize
4KB

Download
memory/2992-0-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2992-5-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download