16912916e639bbf566bedc9041a72cea4865c16eb0adbc289e635a0e4ede20e8

Analysis

max time kernel
149s
max time network
23s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 06:01 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89443f440d1ad224dc477da385537228_JaffaCakes118.exe
Size

455KB
MD5

89443f440d1ad224dc477da385537228
SHA1

3b04e1d02a3d563f95db27091f0357eaf93121f2
SHA256

16912916e639bbf566bedc9041a72cea4865c16eb0adbc289e635a0e4ede20e8
SHA512

fae1e6c86eca30840e5d3574c4a90debab6054316abd7cf686407a5a7a8553cb7ed347cee13bb72c832e5ecba541119afe23d0f32b60b7e83b6c9099affa9e36
SSDEEP

12288:+oUy2e41WHTg2AVqz91BbFlgzJnBhl11UMMnMMMMM:+oT419hVqhDbFyJnBhlPUMMnMMMMM

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
900	mLVrrSBWxbwm.exe

Loads dropped DLL 1 IoCs

pid	Process
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\mLVrrSBWxbwm = "C:\\ProgramData\\mLVrrSBWxbwm.exe"	89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	mLVrrSBWxbwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	mLVrrSBWxbwm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mLVrrSBWxbwm.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Download	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe
900	mLVrrSBWxbwm.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 900	1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe	29
PID 1048 wrote to memory of 900	1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe	29
PID 1048 wrote to memory of 900	1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe	29
PID 1048 wrote to memory of 900	1048	89443f440d1ad224dc477da385537228_JaffaCakes118.exe	29

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	89443f440d1ad224dc477da385537228_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	89443f440d1ad224dc477da385537228_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\89443f440d1ad224dc477da385537228_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\89443f440d1ad224dc477da385537228_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1048
- C:\ProgramData\mLVrrSBWxbwm.exe
  "C:\ProgramData\mLVrrSBWxbwm.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:900

Network

DNS

clickbore.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

clickbore.org

IN A

Response
DNS

clickbore.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

clickbore.org

IN A
DNS

clickwinston-salem.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

clickwinston-salem.org

IN A

Response
DNS

clickwinston-salem.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

clickwinston-salem.org

IN A

Response
DNS

clickhartford.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

clickhartford.org

IN A

Response
DNS

searchbell.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

searchbell.org

IN A

Response
DNS

searchany.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

searchany.org

IN A

Response
DNS

clickicy.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

clickicy.org

IN A

Response
DNS

clickicy.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

clickicy.org

IN A

Response
DNS

clickicy.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

clickicy.org

IN A
DNS

searchbrick.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

searchbrick.org

IN A

Response
DNS

searchbrick.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

searchbrick.org

IN A
DNS

searchbrick.org

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

searchbrick.org

IN A

No results found

8.8.8.8:53

clickbore.org

dns

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

118 B
141 B
2
1

DNS Request

clickbore.org

DNS Request

clickbore.org
8.8.8.8:53

clickwinston-salem.org

dns

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

136 B
300 B
2
2

DNS Request

clickwinston-salem.org

DNS Request

clickwinston-salem.org
8.8.8.8:53

clickhartford.org

dns

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

63 B
145 B
1
1

DNS Request

clickhartford.org
8.8.8.8:53

searchbell.org

dns

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

60 B
142 B
1
1

DNS Request

searchbell.org
8.8.8.8:53

searchany.org

dns

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

59 B
141 B
1
1

DNS Request

searchany.org
8.8.8.8:53

clickicy.org

dns

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

174 B
280 B
3
2

DNS Request

clickicy.org

DNS Request

clickicy.org

DNS Request

clickicy.org
8.8.8.8:53

searchbrick.org

dns

89443f440d1ad224dc477da385537228_JaffaCakes118.exe

183 B
143 B
3
1

DNS Request

searchbrick.org

DNS Request

searchbrick.org

DNS Request

searchbrick.org

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\mLVrrSBWxbwm.exe

Filesize
455KB

MD5
89443f440d1ad224dc477da385537228

SHA1
3b04e1d02a3d563f95db27091f0357eaf93121f2

SHA256
16912916e639bbf566bedc9041a72cea4865c16eb0adbc289e635a0e4ede20e8

SHA512
fae1e6c86eca30840e5d3574c4a90debab6054316abd7cf686407a5a7a8553cb7ed347cee13bb72c832e5ecba541119afe23d0f32b60b7e83b6c9099affa9e36

Download Submit
memory/900-9-0x0000000000CA0000-0x0000000000D15000-memory.dmp

Filesize
468KB

Download
memory/900-8-0x00000000022F0000-0x00000000025F0000-memory.dmp

Filesize
3.0MB

Download
memory/900-11-0x0000000000CA0000-0x0000000000EE8000-memory.dmp

Filesize
2.3MB

Download
memory/1048-1-0x00000000008A0000-0x0000000000A10000-memory.dmp

Filesize
1.4MB

Download
memory/1048-2-0x0000000001360000-0x00000000013D5000-memory.dmp

Filesize
468KB

Download
memory/1048-10-0x0000000001360000-0x00000000015A8000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.