132d8aa11f280e6be5bb0b367046e3765b8fb74b1642b2147352c469aff6e3fd

Analysis

max time kernel
134s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Size

83KB
MD5

767ecfbe7f6757c1509a0b073992f2bd
SHA1

0c61fdaa7e70cd0d6534b539db0918c71926431d
SHA256

132d8aa11f280e6be5bb0b367046e3765b8fb74b1642b2147352c469aff6e3fd
SHA512

cdd94a3e3325e0e6f2ce3ea53bff62c457e49b92a5ad627fe2a974b52c42ea21473b1424789ed9cd8399292c6657267c4f279b420f0beeaccac4cfa6d485f44f
SSDEEP

1536:EdlrfMtHvaN8NRoYNvUNRWBgdXFWgohpjVrs2ryrd1vUQuqwcizSkX:EPM6a7YRWeQhHs2quciu

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "jerbehwjevwqblzv"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92DCA35D-5994-FF5E-69FF-35E7D742CFDB}	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92DCA35D-5994-FF5E-69FF-35E7D742CFDB}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92DCA35D-5994-FF5E-69FF-35E7D742CFDB}\ = "rhthkjvwqhttebrv"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "cvbnlshebkjlzbjn"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "ceztbxbthjrhebls"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "ttlwbkrjsskshttn"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "nclehcbnbbhebxrq"	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92DCA35D-5994-FF5E-69FF-35E7D742CFDB}\LocalServer32	767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\767ecfbe7f6757c1509a0b073992f2bd_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1144-1-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-2-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-6-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-7-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-8-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-9-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-10-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-11-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-12-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-13-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-14-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-15-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-16-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-17-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-18-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-19-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-20-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-21-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-22-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-23-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-24-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-25-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-26-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-27-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-28-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-29-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-30-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-31-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-32-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-33-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-34-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-35-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-36-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-37-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-38-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-39-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-40-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-41-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-42-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-43-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-44-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-45-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-46-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-47-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-48-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-49-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-50-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-51-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-52-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-53-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-54-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-55-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-56-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-57-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-58-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-59-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-60-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-61-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-62-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-63-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-64-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-65-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-1369-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download
memory/1144-5940-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1144-5941-0x0000000000600000-0x000000000061E000-memory.dmp

Filesize
120KB

Download