23119ac962ffbcac92d205d0ad4759be01c6c33b50666b7696130b7dbc546c79

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe
Size

448KB
MD5

4b12df6d6f224c8364fe1fa0800fe585
SHA1

2d475c6bc871a2b39e4a2b8207bb3bb0278127a5
SHA256

23119ac962ffbcac92d205d0ad4759be01c6c33b50666b7696130b7dbc546c79
SHA512

39188a5180220550ea490696fe86c4989e903b1e23bc3139b7a30b6e5feb8219c5bb79bc46986ed13c0e039e15542e7dbe65d957e64886aed280becfe61f2f19
SSDEEP

6144:aiDXUqfmeGqfXDXibVNMAySn/su3G0r0:Nme3yVNMA/sulo

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\windows\\svchost.exe"	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
3636	svchost.exe
3016	dllhost.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe

Drops autorun.inf file 1 TTPs 24 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\x:\Autorun.inf	svchost.exe
File opened for modification	\??\z:\Autorun.inf	svchost.exe
File opened for modification	\??\g:\Autorun.inf	svchost.exe
File opened for modification	\??\k:\Autorun.inf	svchost.exe
File opened for modification	\??\p:\Autorun.inf	svchost.exe
File opened for modification	\??\t:\Autorun.inf	svchost.exe
File opened for modification	\??\v:\Autorun.inf	svchost.exe
File opened for modification	\??\e:\Autorun.inf	svchost.exe
File opened for modification	\??\j:\Autorun.inf	svchost.exe
File opened for modification	\??\m:\Autorun.inf	svchost.exe
File opened for modification	\??\u:\Autorun.inf	svchost.exe
File opened for modification	\??\\|:\Autorun.inf	svchost.exe
File opened for modification	\??\r:\Autorun.inf	svchost.exe
File opened for modification	\??\w:\Autorun.inf	svchost.exe
File opened for modification	\??\{:\Autorun.inf	svchost.exe
File opened for modification	\??\q:\Autorun.inf	svchost.exe
File opened for modification	\??\s:\Autorun.inf	svchost.exe
File opened for modification	\??\y:\Autorun.inf	svchost.exe
File opened for modification	\??\h:\Autorun.inf	svchost.exe
File opened for modification	\??\i:\Autorun.inf	svchost.exe
File opened for modification	\??\l:\Autorun.inf	svchost.exe
File opened for modification	\??\n:\Autorun.inf	svchost.exe
File opened for modification	\??\o:\Autorun.inf	svchost.exe
File opened for modification	\??\}:\Autorun.inf	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\windows\svchost.exe	4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe
File opened for modification	C:\windows\dllhost.exe	svchost.exe
File opened for modification	\??\c:\windows\ravfree.exe	dllhost.exe
File created	C:\windows\svchost.exe	4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000ef582a9b100054656d7000003a0009000400efbee9586e70ef582a9b2e000000a1e1010000000100000000000000000000000000000031632401540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5000310000000000e958957210004c6f63616c003c0009000400efbee9586e70ef582a9b2e000000a0e1010000000100000000000000000000000000000058acd3004c006f00630061006c00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000e958517c100041646d696e003c0009000400efbee9586e70ef582a9b2e00000082e1010000000100000000000000000000000000000049fc0201410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5600310000000000e9586e7012004170704461746100400009000400efbee9586e70ef582a9b2e0000008de1010000000100000000000000000000000000000059aaa2004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000e9586e701100557365727300640009000400efbe874f7748ef582a9b2e000000c70500000000010000000000000000003a0000000000f65ab30055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4804	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1956	4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe
3636	svchost.exe
4804	explorer.exe
4804	explorer.exe
3016	dllhost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 4740	1956	4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe	84
PID 1956 wrote to memory of 4740	1956	4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe	84
PID 1956 wrote to memory of 4740	1956	4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe	84
PID 1956 wrote to memory of 3636	1956	4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe	87
PID 1956 wrote to memory of 3636	1956	4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe	87
PID 1956 wrote to memory of 3636	1956	4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe	87
PID 3636 wrote to memory of 4164	3636	svchost.exe	88
PID 3636 wrote to memory of 4164	3636	svchost.exe	88
PID 3636 wrote to memory of 4164	3636	svchost.exe	88
PID 3636 wrote to memory of 3016	3636	svchost.exe	94
PID 3636 wrote to memory of 3016	3636	svchost.exe	94
PID 3636 wrote to memory of 3016	3636	svchost.exe	94
PID 3636 wrote to memory of 3860	3636	svchost.exe	96
PID 3636 wrote to memory of 3860	3636	svchost.exe	96
PID 3636 wrote to memory of 3860	3636	svchost.exe	96

C:\Users\Admin\AppData\Local\Temp\4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b12df6d6f224c8364fe1fa0800fe585_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:4740
- C:\windows\svchost.exe
  C:\windows\svchost.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c date 1980-01-01
    3⤵
    PID:4164
- - C:\windows\dllhost.exe
    C:\windows\dllhost.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c date 2024-7-15
    3⤵
    PID:3860

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\dllhost.exe

Filesize
372KB

MD5
d562f7073f109d7efd05c790fb5899c2

SHA1
20668afa5117627195092bd00b42777e28e18c1f

SHA256
aa9e5b5716e85d8f7e81bc24d95300e67b595bfa4acec9e316b32256b4d7e364

SHA512
aed3aa12d75d51f0d0241ab66166e8ff9a69287870f920d3bbe09c4215cbe4eef11154d3d25610d6452a6686acde88eb46b9987e88ee2c29f966cf7a9d9d2809

Download Submit
C:\windows\svchost.exe

Filesize
448KB

MD5
4b12df6d6f224c8364fe1fa0800fe585

SHA1
2d475c6bc871a2b39e4a2b8207bb3bb0278127a5

SHA256
23119ac962ffbcac92d205d0ad4759be01c6c33b50666b7696130b7dbc546c79

SHA512
39188a5180220550ea490696fe86c4989e903b1e23bc3139b7a30b6e5feb8219c5bb79bc46986ed13c0e039e15542e7dbe65d957e64886aed280becfe61f2f19

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads