04fa3f9d9ce8f1096eec5d12b880cdfb3840f4653257a567a1cfd7f7047e7d59

Analysis

max time kernel
130s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Size

762KB
MD5

bfc78d19ffa9e8a3024311ecdbe3d98c
SHA1

15a1ea8fa5753da12cbaee034a01f6d527a1c187
SHA256

04fa3f9d9ce8f1096eec5d12b880cdfb3840f4653257a567a1cfd7f7047e7d59
SHA512

ebc436a8815f1e6e0721d2304b73fe4e254202f1572b56d1c21019651afb0b86468e34d1c4ab09f60b065a9b0d35b48ee197bec980278d4667c10526ef711f9e
SSDEEP

12288:8DouDYbjjHaGjmMMTkuaoIzQm4srlWJzzJeTJkxne027FdM6vtRx/1/5G:EaHdkkuarlWJZQk9e027PMCx/1hG

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\ProxyStubClsid32	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\0\win32	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\FLAGS	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\ = "Inst Class"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\HELPDIR	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers.1	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers.1\CLSID	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\VersionIndependentProgID\ = "missels.badgers"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\FLAGS\ = "0"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\TypeLib\Version = "1.0"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\TypeLib	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\Version\ = "1.0"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers.1\CLSID	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers\CurVer	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers\CurVer	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\VersionIndependentProgID	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\ProxyStubClsid32	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers\ = "Inst Class"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\TypeLib\ = "{099ce186-7025-4183-aefc-08b1b8b6c61e}"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\ProxyStubClsid32	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\ProgID	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\0	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\ProxyStubClsid32	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers.1\CLSID\ = "{08274839-baf8-4372-90f4-59262f8953fb}"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\FLAGS	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\0	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\TypeLib	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\VersionIndependentProgID	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\TypeLib	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\Programmable	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers\CurVer\ = "missels.badgers.1"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\ProgID	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\Version	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\ = "InstallerLib"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\ = "IBoot"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\TypeLib\ = "{099CE186-7025-4183-AEFC-08B1B8B6C61E}"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers.1\ = "Inst Class"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\ProgID\ = "missels.badgers.1"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\TypeLib\ = "{099CE186-7025-4183-AEFC-08B1B8B6C61E}"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\TypeLib\Version = "1.0"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\TypeLib	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\HELPDIR	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\missels.badgers.1	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\Programmable	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\TypeLib	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\LocalServer32	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57202AE4-4E15-48A6-A0EF-E373934507B6}\ = "IBoot"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe:typelib"	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08274839-baf8-4372-90f4-59262f8953fb}\LocalServer32	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{099CE186-7025-4183-AEFC-08B1B8B6C61E}\1.0	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe:typelib	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5000	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
5000	bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bfc78d19ffa9e8a3024311ecdbe3d98c_JaffaCakes118.exe:typelib

Filesize
8KB

MD5
fc2ca664573b04ab394c5d4dcedb760e

SHA1
3ce5bfcf2c1d5396d55a5fd00e3b7026b0ae98f0

SHA256
27de66f60ff0935bd2bb47c48d7b8f9a398045f5718b4d12143817df912d36eb

SHA512
79fb931333760ac63ebce35eee60787813e55a2e01f8e572fd1afb59fb9c4a55cb38d77b55e4a4d86e3ede0e4e9722c1502318c955132c0f5e010db9b1537916

Download Submit
memory/5000-7-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-18-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-0-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-6-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-9-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-1-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-12-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/5000-4-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-19-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-21-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-23-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-22-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-25-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download
memory/5000-27-0x0000000002C90000-0x0000000002D64000-memory.dmp

Filesize
848KB

Download