9826c56553310f47f1c93419870ed935cc92b00cec23c7b0e04a275c00093c78

Analysis

max time kernel
140s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe
Size

1.0MB
MD5

b4cf2d93bab4987e99b6056cc1c2f613
SHA1

9e453855d6000d5c8a192eebcfcda0b3eae05a92
SHA256

9826c56553310f47f1c93419870ed935cc92b00cec23c7b0e04a275c00093c78
SHA512

b4e875f01dbfc253e2ddeac35c81756cbabf8121d521d1e6b183f8af21cdd56157c18be97ae312c70bce162d167b8dd46b3ef474e38b610b5839b046ae493db7
SSDEEP

24576:xIqpr552da20BSeveKyTiOxOlO07paHd7G:bFwd0fvKZxOxF2d7G

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2464	Setup.exe

Loads dropped DLL 2 IoCs

pid	Process
1068	b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe
1068	b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1068-0-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/1068-64-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	Setup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2464	Setup.exe
2464	Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2464	1068	b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe	29
PID 1068 wrote to memory of 2464	1068	b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe	29
PID 1068 wrote to memory of 2464	1068	b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe	29
PID 1068 wrote to memory of 2464	1068	b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe	29
PID 1068 wrote to memory of 2464	1068	b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe	29
PID 1068 wrote to memory of 2464	1068	b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe	29
PID 1068 wrote to memory of 2464	1068	b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\Setup.exe
  "aeac2814-61bf-4a12-8b11-c5ea3cfa382c\Setup.exe" "C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\index.html"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\data.js

Filesize
40KB

MD5
f719a0f4fbdc6adcfaf69d5234dc132a

SHA1
282f239f5f5adfb9651bb690e611085b9a5a7f80

SHA256
4dbca5cf6f59d12ad106479b05ef5c1a0638b87e0e5fd971d29a203f1b47a74b

SHA512
a562f1cf0e36a2fa9dc332fade15b46959f78fd22769a9cf842fe14f289cbd8e8fb69b46c65f9e04b98fe48e3846e3401637c636510e0d9344b591f1baa3beaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\data0.js

Filesize
244B

MD5
13cf1e437106581c0cbd7a8a560918a5

SHA1
ad9f44433a71cfc0ff2f5e5dbe64053a0ec943e9

SHA256
d8ae1a18a8e51963dafd8eac17194cae91f785d469f2653df8daff12ef027c15

SHA512
b3a3b489dffd0c6245cefd24a16eceed455be5e073d72e30ab948d9b8a22bd3254818f422b65a8803bc83389bdc2ff7f95afb615dd24567c39e07501cd7d3b6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\img\0.gif

Filesize
5KB

MD5
e99c30a014f2c52366a8b460553ce982

SHA1
6177a9c60e1027e908a4019321570992729ee7ef

SHA256
e5dc8cc6f456ed8a36923946f962c04a38c13da21654d8977acf3012a2ec3bab

SHA512
b4ac564f1fc728526277ac2fde64c56b6a5f3bc69e71a68a8688cc1f0fbecdd7e30b28219862864adf0028c770ee44ce74e6f509ae5759023cc286b2d5e9189c

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\index.html

Filesize
489B

MD5
263e7937ad144efa91dc45e29a4238c5

SHA1
baab29f7377b9bd43175d6e6cf0a7e317f3f3e48

SHA256
b5f7d03b8819dbcef07a1cb98522e76e5f89770519cfca0d7799f711a579f7a5

SHA512
1308bd31e98a67ca909a96ad46858bc5ff51774b88ea5934495dfe1bfd8312bfd86d0d01adb1cc4027a4bb15dc9b5e9965f45ba860eb25ec4d489e16b68014af

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\css\formcontrols.css

Filesize
4KB

MD5
ceb254db6626fa437a395e52d2c11da2

SHA1
74c224224b7f8ffd209bf346cbd133e04655cb3a

SHA256
5bab3a570e5e62cac658996a5db974b43a0a932d51ddffcc5e437ebd33ba0d39

SHA512
625ca3564e7eb48e178f1440cdbb69c51e9fb21086f4eef8d210462c83de2a171dd4789f821687f9b877682532d05c1418b5e19f52f7bd94c039ea90ab93ab5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\css\layout.css

Filesize
453B

MD5
9565c38ee56f996aac2fb0906cc1882c

SHA1
95ee88fca47973c939454d98bb8784f7082a8613

SHA256
ac068ae6094a331acc49424d65e4c986f5e1a15df077476edbf38dd0de4817f8

SHA512
75fbd81bed85a46e5da6a7c589e3ef12a9fdb6578dec95d0aea8f99af8e94440e7edcfdab8e15d87471b7a6d1dab53c293b466dedb1ca4778bf0fe1d25b9efc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\css\main.css

Filesize
2KB

MD5
f831bb398578407ecfb03ac2ac12a725

SHA1
b4ccf4aa0ac4f796e5d4f0f7e1f5004c1173c31a

SHA256
ed577dffdb0291e142ff6d1c4a00d03d0c98482ee5c3fc12ed7585a19e2300a9

SHA512
2643a6386e2f80b678d2d66258486d63e66975507aab382f1564804bc02630792316c2d57dbd8849b107e8e24a9c05352633bedeb65c82553e13e6827a5cd48d

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\img\button_normal.png

Filesize
148B

MD5
ef78dfa76fe087a66d8ebfa34c5f7b9e

SHA1
8d62509ae458125e3e3fdde063cb653b65b4d13b

SHA256
a0a7b4fdde3e8b5c538d4506f4dac85f4794f5cfbba29397719ae170c57cefdd

SHA512
b586ba703aaf592f91a29cc8ef23b5ff7fd4e19baf0f344fe16bbdb7a1689eda831cdf69877225859a95be2efe76a52b5e2de28d1fd3dcb5959cbbd4d04b0112

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\img\hr.gif

Filesize
43B

MD5
16616cf0c229b6b1e817a68c732cf889

SHA1
4f5b2f8372dcc50071491613eb75b04f57f529ee

SHA256
a5701c519fef62adb3e854ddf459d62a1a79c0610071b056a2cace8532a92205

SHA512
ddbc1f1a869bd76bbe9284f7825acaa0417285123b3085ac69b241a6eadd1d8b8993f669955952d7b9b6afbc0f546dd2308acb540469ff7b15310543c91337b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\js\app.js

Filesize
124KB

MD5
35c8675b6f9aab03082a91e29017e954

SHA1
c89a743eb67ffa2325cc40c01d3c87558a639235

SHA256
dd56b36a03e6ef0cba30ab2f9f37072f4a2e44a229ae3d6b8ff4c1546914fccf

SHA512
a9c0382967613cf136f863d83cf8dce9a6c8d9c840bf263b7782fbf377e1940a2fb36a330ad307ba719f879564cd7ce296c102b71918ccd84cd3f27b68c5c327

Download Submit
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\js\formcontrols.min.js

Filesize
5KB

MD5
3c283c0123f825bbe0452dd02db776d3

SHA1
b77d2f2adcdda5fd666df6e240bcdc35e61b2ff5

SHA256
2b03ddbc59d18d890261bab13cab3613235607745508018cb8227d0153e79f57

SHA512
bbd6760481660edec51220235f6e656d232a0c98d8197616a105ea1d149d83dfc0b70268e96d606281bd5744de56bced0eae3931e46a2cf8c6eeb8659183d783

Download Submit
\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\Setup.exe

Filesize
628KB

MD5
dffd68ca4cbe112f5fd55f3e1bd1f9c8

SHA1
7d6f3584cd910dd2cbc1b65ea8105d35b65e9db4

SHA256
b5ba6297685da0e59bf66e0557f1d3ded2c51211a8392de55c4bfe7896fc279d

SHA512
6529472c62a8cd0255676a1d32c28c4b9c45d5369f4973ca4357af220e0c1df1ef12cfb80414d2f273350f4a1c3c0f55b4074729a8a2629a343a5d9f91a98a7d

Download Submit
\Users\Admin\AppData\Local\Temp\nso3A44.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/1068-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1068-64-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2464-38-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2464-67-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2464-66-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download