622d580dc26dc81d0d9a4c0a396db513737e7237d166e2b6c1d9a66fa71821e9

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe
Size

2.0MB
MD5

93af744fa95d6ead692424cbbab3e8e5
SHA1

286b3ddd319bd8d5e49db6675ff6dada73d86930
SHA256

622d580dc26dc81d0d9a4c0a396db513737e7237d166e2b6c1d9a66fa71821e9
SHA512

d4097194ffe68f31412756551c0f154f15ad6fdaa3e485a6b4815eb64f546bc0884541129f64ed5cb46e6bdefb724749c065f3bb7622799611adf111d9ebfdfc
SSDEEP

49152:r8cUfZsF6GWhsesortO2FAZ8mlQuR7Djfan3zIEUttrx7H2:r8XxxGWhDjWDQ+QoDx2

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2016	5ke5w833eo7e9wm.exe
2148	6eqxwk49u166oll.exe

Loads dropped DLL 10 IoCs

pid	Process
1644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe
1644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe
2016	5ke5w833eo7e9wm.exe
2016	5ke5w833eo7e9wm.exe
2016	5ke5w833eo7e9wm.exe
2016	5ke5w833eo7e9wm.exe
2016	5ke5w833eo7e9wm.exe
2148	6eqxwk49u166oll.exe
2148	6eqxwk49u166oll.exe
2148	6eqxwk49u166oll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ke5w833eo7e9wm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6eqxwk49u166oll.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\FLAGS\	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\0	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\ = "Igiwerhej.Egavo class"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\InprocServer32	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\InprocServer32\ = "%SystemRoot%\\SysWow64\\adsmsext.dll"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\InprocServer32\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\ProgID\	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\Version	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\0\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\0\win32\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\HELPDIR\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\FLAGS\ = "0"	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\ProgID\ = "MSExtGroup"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\TypeLib	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\0\win32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\GROOVE.EXE\\120"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\FLAGS	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\HELPDIR	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\TypeLib\	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\ProgID	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\ = "Groove Common Components 1.0 Type Library"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{627F915C-E58B-FAF9-9286-E5435125A7E8}\1.0\0\win32	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\TypeLib\ = "{627F915C-E58B-FAF9-9286-E5435125A7E8}"	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\Version\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C2DCFB1-2923-4F93-CBBA-9B91A3BF0504}\Version\ = "1.0"	6eqxwk49u166oll.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2148	6eqxwk49u166oll.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2016	1644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2016	1644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2016	1644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2016	1644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2016	1644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2016	1644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2016	1644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe	30
PID 2016 wrote to memory of 2148	2016	5ke5w833eo7e9wm.exe	31
PID 2016 wrote to memory of 2148	2016	5ke5w833eo7e9wm.exe	31
PID 2016 wrote to memory of 2148	2016	5ke5w833eo7e9wm.exe	31
PID 2016 wrote to memory of 2148	2016	5ke5w833eo7e9wm.exe	31
PID 2016 wrote to memory of 2148	2016	5ke5w833eo7e9wm.exe	31
PID 2016 wrote to memory of 2148	2016	5ke5w833eo7e9wm.exe	31
PID 2016 wrote to memory of 2148	2016	5ke5w833eo7e9wm.exe	31

C:\Users\Admin\AppData\Local\Temp\93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\5ke5w833eo7e9wm.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\5ke5w833eo7e9wm.exe" -e -pe17js56fq1jh4vq
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\6eqxwk49u166oll.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\6eqxwk49u166oll.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\RarSFX0\5ke5w833eo7e9wm.exe

Filesize
1.9MB

MD5
8666dfab99a3fce2ea7a918b066e65aa

SHA1
543bc086ecd3385f1fc318d9b0ee0e25826b9461

SHA256
5a006ca284cfcc4943936eed87e8a3bf4c7c88f62ca0fa0886f668ab334dbfa5

SHA512
a3b286394b2c752e67a7f68b56c3e9d00fccba2c97940a9c3dafd480a30f2129cf6936ed18ef51ca692aa025481fff94e46f983bc2351023f0b1b1495604fa8e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\6eqxwk49u166oll.exe

Filesize
1.8MB

MD5
136ab618780fb3403e2dcc821304df9f

SHA1
02d6c8f4666ec537e5b3a18e9b6524b352aff7c2

SHA256
854970158c1514690772a753fdaed4662ece99019f83c2cb6139765b8b02fd7e

SHA512
889825d9ec2906b067f20a8194863e3f88ebaf7a65462b0deecee52fba4ae786677403e3cf4d685775437960114a449ed9d57a180b0e96cdbfe25b0466c9eeb8

Download Submit
memory/2016-28-0x0000000003E60000-0x0000000004239000-memory.dmp

Filesize
3.8MB

Download
memory/2016-29-0x0000000003E60000-0x0000000004239000-memory.dmp

Filesize
3.8MB

Download
memory/2148-31-0x0000000001070000-0x0000000001449000-memory.dmp

Filesize
3.8MB

Download
memory/2148-32-0x0000000001070000-0x0000000001449000-memory.dmp

Filesize
3.8MB

Download
memory/2148-33-0x0000000001070000-0x0000000001449000-memory.dmp

Filesize
3.8MB

Download
memory/2148-30-0x0000000000400000-0x00000000007D9000-memory.dmp

Filesize
3.8MB

Download
memory/2148-34-0x0000000000400000-0x00000000007D9000-memory.dmp

Filesize
3.8MB

Download