148c1716b9308099e75d824a04bec51e20b3c7bb3428fac1f119927cc5fc49e2

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe
Size

549KB
MD5

b4925ce13fc149461ed338556582ef40
SHA1

5a2c8fcc39a0e7efbcb2ec635cd85507d315581b
SHA256

148c1716b9308099e75d824a04bec51e20b3c7bb3428fac1f119927cc5fc49e2
SHA512

8c67ec5928ad9f9760488d81ad5ed143b3185e51578636a11aa1a413100b15e23dae5dc067ced3f72c4bd968a69ad84aee1b9700a1210b1b26688f2857566d0b
SSDEEP

12288:TbdJigLGKLPe/HWuj2OH1c2obY7gvKOB2yLvjk:nvigLJPyHWuq6ocQKOB2Uvjk

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2684	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	conime.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	conime.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\conime.exe	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe
File created	C:\Windows\conime.exe	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	conime.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	conime.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-61-fc-d1-92-e4	conime.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	conime.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	conime.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E11BBC79-2AAF-4B33-9716-5558340EC3D5}\WpadDecisionTime = 70dd63e9f8f3da01	conime.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E11BBC79-2AAF-4B33-9716-5558340EC3D5}\WpadNetworkName = "Network 3"	conime.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-61-fc-d1-92-e4\WpadDecisionTime = 70dd63e9f8f3da01	conime.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	conime.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E11BBC79-2AAF-4B33-9716-5558340EC3D5}\WpadDecisionReason = "1"	conime.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E11BBC79-2AAF-4B33-9716-5558340EC3D5}\a6-61-fc-d1-92-e4	conime.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-61-fc-d1-92-e4\WpadDecisionReason = "1"	conime.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	conime.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00fd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	conime.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	conime.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	conime.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	conime.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	conime.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E11BBC79-2AAF-4B33-9716-5558340EC3D5}	conime.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	conime.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-61-fc-d1-92-e4\WpadDetectedUrl	conime.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E11BBC79-2AAF-4B33-9716-5558340EC3D5}\WpadDecisionTime = 1056ca1ef9f3da01	conime.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-61-fc-d1-92-e4\WpadDecisionTime = 1056ca1ef9f3da01	conime.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	conime.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	conime.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00fd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	conime.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E11BBC79-2AAF-4B33-9716-5558340EC3D5}\WpadDecision = "0"	conime.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-61-fc-d1-92-e4\WpadDecision = "0"	conime.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe
Token: SeDebugPrivilege	2664	conime.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	conime.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2684	2676	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe	32
PID 2676 wrote to memory of 2684	2676	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe	32
PID 2676 wrote to memory of 2684	2676	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe	32
PID 2676 wrote to memory of 2684	2676	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe	32
PID 2676 wrote to memory of 2684	2676	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe	32
PID 2676 wrote to memory of 2684	2676	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe	32
PID 2676 wrote to memory of 2684	2676	b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe	32
PID 2664 wrote to memory of 2812	2664	conime.exe	31
PID 2664 wrote to memory of 2812	2664	conime.exe	31
PID 2664 wrote to memory of 2812	2664	conime.exe	31
PID 2664 wrote to memory of 2812	2664	conime.exe	31

C:\Users\Admin\AppData\Local\Temp\b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4925ce13fc149461ed338556582ef40_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2684

C:\Windows\conime.exe
C:\Windows\conime.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\conime.exe

Filesize
549KB

MD5
b4925ce13fc149461ed338556582ef40

SHA1
5a2c8fcc39a0e7efbcb2ec635cd85507d315581b

SHA256
148c1716b9308099e75d824a04bec51e20b3c7bb3428fac1f119927cc5fc49e2

SHA512
8c67ec5928ad9f9760488d81ad5ed143b3185e51578636a11aa1a413100b15e23dae5dc067ced3f72c4bd968a69ad84aee1b9700a1210b1b26688f2857566d0b

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
5dc14f352215789338206fc88562e155

SHA1
0bbae106d0f59c58939932caf5092872aee8a651

SHA256
45363e2f584a061cb76390b2a81d3948a4157d598a2f3be19e488921d7a7c547

SHA512
dd4e87070e08c03e9b7803ad8e823cd15cbfe959f7260d43358018fa0ebb1d09a3a8d429b2b2d3c4a6b1b35c69cda0ea5ddf886818d34fc801e86ee59d6a3205

Download Submit
memory/2664-42-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2664-38-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2664-25-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2676-9-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download
memory/2676-7-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/2676-16-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2676-15-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2676-14-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2676-13-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2676-12-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2676-11-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2676-10-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/2676-1-0x0000000001C90000-0x0000000001CE0000-memory.dmp

Filesize
320KB

Download
memory/2676-8-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/2676-17-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2676-6-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/2676-5-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/2676-4-0x0000000001E40000-0x0000000001E41000-memory.dmp

Filesize
4KB

Download
memory/2676-3-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2676-2-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/2676-18-0x0000000002AC0000-0x0000000002BC0000-memory.dmp

Filesize
1024KB

Download
memory/2676-19-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2676-20-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/2676-36-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2676-35-0x0000000001C90000-0x0000000001CE0000-memory.dmp

Filesize
320KB

Download
memory/2676-21-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/2676-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download