6b5a0e40bd7225e11e8fbc497c70a89c89f948aaaa984773a213a326ff1a7642

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe
Size

1.3MB
MD5

b0ac8a187a88d616f43dcb2d31e6ccea
SHA1

d542b218ade2c4cc509048e9c0d3a741c24f8568
SHA256

6b5a0e40bd7225e11e8fbc497c70a89c89f948aaaa984773a213a326ff1a7642
SHA512

32dd4c2ec0ad13c8cd34a1734d4a3d4535d6a377103375c9f0a5851e71e1dac750c29bd538389bc027f086cb68bf3049d18ba85ccb1c9bb7cfdec91639646f72
SSDEEP

24576:Rw3Iaix60wl0pNB+snrg0g3E655XKFmPH5JRDzJILWZy+90dj9xo7:Rl3ylaNB3g0dgWmvXRDlwJhjc7

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3156	b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe
3156	b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe
3156	b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HBCheckPermission.txt	b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\HBCheckPermission.txt	b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5c0000000100000004000000000400007e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64	b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3156	b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe
3156	b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0ac8a187a88d616f43dcb2d31e6ccea_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_1F4D98073CB9D76D41243526F78362EC

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C3948BE6E525B8A8CEE9FAC91C9E392_1F4D98073CB9D76D41243526F78362EC

Filesize
416B

MD5
403b345a64ae4d64d8bbcbd9a2f64ae8

SHA1
1e2be607f993a70e2c0ac30b3139158400577ad7

SHA256
0514206b13f93e838f8ad45e3fa01553a972e5e1eeaf3a40f165e974b8adab93

SHA512
020915bc9e04db55ee5bbcf15546dce353ac0d0469247fa29728b0a3d322627f07ffc4dbe851a36c00a6f537160b054f351c36b8c1ed72ba2d9cf3c636258dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn8203.tmp\Install.dll

Filesize
236KB

MD5
95fc382abf1b2ce439b34e881654de0f

SHA1
41bda0cde6df5753a39873db02c7723d27e64046

SHA256
f53ce205133ac6cd4eca87a98127ff19d5f49b2443312af7704c33b3a5de278c

SHA512
c65b1eee9cfa4447384b25c9fc859a429076758d1dfe1b49a7e73b5b270f1f32a818f3e39dd53f69ec7b73b58c07a3ea88e686e2ec15cde21b1606b7bfee9aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn8203.tmp\System.dll

Filesize
10KB

MD5
05e52213cfa17dee760186462a9645ed

SHA1
f6d5e82080bbba65db7d54e89250c95af833aae3

SHA256
d9d3ffa4c7d7a152f435f4777e72aa1b6a6c0555f277e59eedebc587c3b66ba5

SHA512
586eea0bec6345b437667ce528bc2396427dd444a396456e38046a8962e92a52e7ee62b9f6c97f41bc1fb4a1b3905a302d6f7055e26b84e60709ba3b416ad172

Download Submit