a2c56ed2746022bf8021a9a36e97c5eaffba96c28d7844fb3b4f04ae985a8bff

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Size

156KB
MD5

a37a7e64eec3a6f3bd24c48ad0233393
SHA1

d318a0281da070362c806247a3291d464d76a614
SHA256

a2c56ed2746022bf8021a9a36e97c5eaffba96c28d7844fb3b4f04ae985a8bff
SHA512

c43690f448fe27259dd0258b9dc6c0df96718f0debda15e4a85d64954af6e0dedbe3f8e1afb91e1f0f86bf26072088dec299f4b4f847d8d139631580d28a75f6
SSDEEP

1536:9kQyXtssi/sJ5YsmAjSFWqnqZdtgrNMR25DmQnl0cddn:9kQyXtCg57mFDq7tgrNMIDmQnl0q

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\dao.ico	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TYPEDURLS	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Window Title = "Microsoft Internet Explorer"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.4462.com/?yya"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.4462.com/?yya"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\1 = "20240817"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\cdafile2 = "843"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "0"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)\Command	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "1"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.4462.com/?yya"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)\Command\ = "Rundll32.exe"	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2200	640	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe	29
PID 640 wrote to memory of 2200	640	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe	29
PID 640 wrote to memory of 2200	640	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe	29
PID 640 wrote to memory of 2200	640	a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\a37a7e64eec3a6f3bd24c48ad0233393_JaffaCakes118.exe
  2⤵
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.url

Filesize
156B

MD5
ad911fa6c00696246b549ec56874abcd

SHA1
56f5164766e5fa452f4910ce2b14b5ed4ecee0f4

SHA256
920bba5d46528225276cec81a01f0fc01ae24c18e334961a8e261d331fbc3115

SHA512
b41f5999cd13ab89da8c75d4f5ad96c0cd554adba1a6a27d8099cbee946b6f0fc7e638087c11d147136719a7de0d4e94c4f4caabc7c9a092c2d564995392880d

Download Submit
memory/640-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/640-13-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2200-12-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads