Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11-08-2024 13:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe
-
Size
336KB
-
MD5
8aa1cfb4122c71c0684e82c3749b1da4
-
SHA1
940eccf8c2c708513b4b7d1ff00a9c475c0aefd2
-
SHA256
ef2a69935322c5db3ce2559c176528fe8ebae0e3a5d87a69cf3a5d0d36fec55d
-
SHA512
2c34de9c0f0301ffcf22c247775e70b9ace16d5c3943510d0ff6de95d1be8f994d0b00cf0e394405eaa6ef57c77ecd9c74d1885d1cf5c7d4c27f6521fcc0e11c
-
SSDEEP
6144:pk+TvfDzsyocDrVcADoCCx76s4H9/7yK/ylkN/pkT:+UNaA0CCx76s4d/7Zylq
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 1996 oyn.exe -
Executes dropped EXE 1 IoCs
pid Process 1996 oyn.exe -
Loads dropped DLL 2 IoCs
pid Process 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe -
Modifies system executable filetype association 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\oyn.exe\" -a \"%1\" %*" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\start oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\runas oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\Content Type = "application/x-msdownload" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\DefaultIcon oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\DefaultIcon\ = "%1" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\start\command oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\open\command oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\runas\command oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\ = "Application" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\open oyn.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\WINDOWS\\system32\\ctfmon.exe" oyn.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe -
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\start\command oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\runas\command oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\runas oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\Content Type = "application/x-msdownload" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\start oyn.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\DefaultIcon\ = "%1" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\start\command oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\DefaultIcon oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\DefaultIcon\ = "%1" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\oyn.exe\" -a \"%1\" %*" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\runas\command oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\open oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\open oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\open\command oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\oyn.exe\" -a \"%1\" %*" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\Content Type = "application/x-msdownload" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\start oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\start\command\IsolatedCommand = "\"%1\" %*" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\ = "exefile" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\runas oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\open\command oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.exe\shell\start\command\ = "\"%1\" %*" oyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\ = "Application" oyn.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\exefile\DefaultIcon oyn.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 1996 oyn.exe 1996 oyn.exe 1996 oyn.exe 1996 oyn.exe 1996 oyn.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2580 explorer.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe Token: SeShutdownPrivilege 2580 explorer.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 1996 oyn.exe 1996 oyn.exe 1996 oyn.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 1996 oyn.exe 2580 explorer.exe 2580 explorer.exe 1996 oyn.exe 1996 oyn.exe 2580 explorer.exe -
Suspicious use of SendNotifyMessage 20 IoCs
pid Process 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 2580 explorer.exe 1996 oyn.exe 1996 oyn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1996 oyn.exe 1996 oyn.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1644 wrote to memory of 1996 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 30 PID 1644 wrote to memory of 1996 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 30 PID 1644 wrote to memory of 1996 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 30 PID 1644 wrote to memory of 1996 1644 8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe 30 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\oyn.exe"C:\Users\Admin\AppData\Local\oyn.exe" -gav C:\Users\Admin\AppData\Local\Temp\8aa1cfb4122c71c0684e82c3749b1da4_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1996
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2580
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336KB
MD58aa1cfb4122c71c0684e82c3749b1da4
SHA1940eccf8c2c708513b4b7d1ff00a9c475c0aefd2
SHA256ef2a69935322c5db3ce2559c176528fe8ebae0e3a5d87a69cf3a5d0d36fec55d
SHA5122c34de9c0f0301ffcf22c247775e70b9ace16d5c3943510d0ff6de95d1be8f994d0b00cf0e394405eaa6ef57c77ecd9c74d1885d1cf5c7d4c27f6521fcc0e11c