f84bd1531500638f433739e09bb01af91e885a148a107cb23553ff6e8bb3634d

Analysis

max time kernel
148s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Size

76KB
MD5

39961cb55fd3ca36bc9ec9da5026e91e
SHA1

47e89a995ad66a7c65b6a07899e54e01f2c3027d
SHA256

f84bd1531500638f433739e09bb01af91e885a148a107cb23553ff6e8bb3634d
SHA512

ab442a732cf90e7995e4f077c66b615a38ec91376567dc5d42f3d76d6c53e71ba7b0e2a455543026ada1f4797c5757cb32c93dcad43b123d327bb19cf84ed7c9
SSDEEP

768:be8bNRqsuhlGOBnhgFwumSCbxTGy/BBGg4NKJJKqUThbJ32+ve7i40vN0TlT+Xkz:znqJu3abBGy3G8V0iuoKG

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	dsnp.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dsnp.exe

Executes dropped EXE 1 IoCs

pid	Process
2520	dsnp.exe

Loads dropped DLL 2 IoCs

pid	Process
1980	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
1980	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	dsnp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	dsnp.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	dsnp.exe
File opened (read-only)	\??\T:	dsnp.exe
File opened (read-only)	\??\Y:	dsnp.exe
File opened (read-only)	\??\E:	dsnp.exe
File opened (read-only)	\??\L:	dsnp.exe
File opened (read-only)	\??\M:	dsnp.exe
File opened (read-only)	\??\P:	dsnp.exe
File opened (read-only)	\??\Q:	dsnp.exe
File opened (read-only)	\??\S:	dsnp.exe
File opened (read-only)	\??\U:	dsnp.exe
File opened (read-only)	\??\Z:	dsnp.exe
File opened (read-only)	\??\B:	dsnp.exe
File opened (read-only)	\??\K:	dsnp.exe
File opened (read-only)	\??\N:	dsnp.exe
File opened (read-only)	\??\O:	dsnp.exe
File opened (read-only)	\??\I:	dsnp.exe
File opened (read-only)	\??\V:	dsnp.exe
File opened (read-only)	\??\W:	dsnp.exe
File opened (read-only)	\??\G:	dsnp.exe
File opened (read-only)	\??\H:	dsnp.exe
File opened (read-only)	\??\J:	dsnp.exe
File opened (read-only)	\??\X:	dsnp.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\maxtrox.txt	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	dsnp.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	dsnp.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	dsnp.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	dsnp.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\private_browsing.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	dsnp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	dsnp.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	dsnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	dsnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	dsnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	dsnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	dsnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	dsnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	dsnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	dsnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	dsnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	dsnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	dsnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	dsnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	dsnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	dsnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	dsnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	dsnp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1980	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
2520	dsnp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2520	1980	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe	30
PID 1980 wrote to memory of 2520	1980	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe	30
PID 1980 wrote to memory of 2520	1980	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe	30
PID 1980 wrote to memory of 2520	1980	39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- \??\c:\Documents and Settings\Admin\Application Data\Microsoft\dsnp.exe
  "c:\Documents and Settings\Admin\Application Data\Microsoft\dsnp.exe" 39961cb55fd3ca36bc9ec9da5026e91e_JaffaCakes118
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\Windows 3D.scr

Filesize
76KB

MD5
8c6ebe86256aea531b5f792b36dda8f6

SHA1
266fcc2b4f7c43e92199e301bcca8a62e5bfd4c0

SHA256
60c03800db97deb27fda77a515c8ebf2a718e693d50d9a491fa144fbeb6dd75a

SHA512
53f49a06adfa0ad5b819865b7613b50332d545695cc2595ac4e214340f74dc6fe2084f09ee7a760896bfc51951ee8a837f4f79881c44c6d2c8d9d92a0796eaf3

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\dsnp.exe

Filesize
76KB

MD5
f30736a926f2da4d985b178541caa846

SHA1
d3e2d324781b0949a38a7c662f5f9ccc482c489c

SHA256
b8053b14ed529c706c5cf63233cd40c6e2d968578c7e2a544d2e300517625c3c

SHA512
b5b60eb98464d3e05c7fe621ac5ca6080040e2e5d36ea84a6d35ad1396223c53909ef74ddaaee22665602ff4fbbc0c1433dfd904bd2b2dc1ac2d6f5d1823b021

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads