12a3c2202c9aa43188c8e6b7444a8705bfe25581c275fd1f63b65013fa835b2c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe
Size

968KB
MD5

bfe3e82de14df990b26a16f31bad8d0c
SHA1

09fb10516a51b3f2208c3d40c4bfaa0dea3f1aeb
SHA256

12a3c2202c9aa43188c8e6b7444a8705bfe25581c275fd1f63b65013fa835b2c
SHA512

20b7ea37c1d6d06ddf3435388855bdeac045a869a3a9082d9a77aff87e6945bff0d1e123453e976fe236245843824b021aa25a3ffe586feff3887ff213626bf9
SSDEEP

24576:mgtbtfFcicu9/AGdSHlXEYprdDJ5Qk7I/Oylc8Cnrz:379Iu9/9dSHlXECrBJ5r7Ibl7or

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2416	instract.exe

Loads dropped DLL 9 IoCs

pid	Process
2556	bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe
2556	bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
2648	2416	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	instract.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2416	instract.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0"	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals"	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals"	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Programmable	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\instract.exe\""	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version\ = "1.0"	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0"	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\ = "CBrowserExternal Class"	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\instract.exe"	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\instract.exe"	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\ = "SmartInstallerLib"	instract.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS\ = "0"	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}	instract.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib	instract.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2088	wmic.exe
Token: SeSecurityPrivilege	2088	wmic.exe
Token: SeTakeOwnershipPrivilege	2088	wmic.exe
Token: SeLoadDriverPrivilege	2088	wmic.exe
Token: SeSystemProfilePrivilege	2088	wmic.exe
Token: SeSystemtimePrivilege	2088	wmic.exe
Token: SeProfSingleProcessPrivilege	2088	wmic.exe
Token: SeIncBasePriorityPrivilege	2088	wmic.exe
Token: SeCreatePagefilePrivilege	2088	wmic.exe
Token: SeBackupPrivilege	2088	wmic.exe
Token: SeRestorePrivilege	2088	wmic.exe
Token: SeShutdownPrivilege	2088	wmic.exe
Token: SeDebugPrivilege	2088	wmic.exe
Token: SeSystemEnvironmentPrivilege	2088	wmic.exe
Token: SeRemoteShutdownPrivilege	2088	wmic.exe
Token: SeUndockPrivilege	2088	wmic.exe
Token: SeManageVolumePrivilege	2088	wmic.exe
Token: 33	2088	wmic.exe
Token: 34	2088	wmic.exe
Token: 35	2088	wmic.exe
Token: SeIncreaseQuotaPrivilege	2088	wmic.exe
Token: SeSecurityPrivilege	2088	wmic.exe
Token: SeTakeOwnershipPrivilege	2088	wmic.exe
Token: SeLoadDriverPrivilege	2088	wmic.exe
Token: SeSystemProfilePrivilege	2088	wmic.exe
Token: SeSystemtimePrivilege	2088	wmic.exe
Token: SeProfSingleProcessPrivilege	2088	wmic.exe
Token: SeIncBasePriorityPrivilege	2088	wmic.exe
Token: SeCreatePagefilePrivilege	2088	wmic.exe
Token: SeBackupPrivilege	2088	wmic.exe
Token: SeRestorePrivilege	2088	wmic.exe
Token: SeShutdownPrivilege	2088	wmic.exe
Token: SeDebugPrivilege	2088	wmic.exe
Token: SeSystemEnvironmentPrivilege	2088	wmic.exe
Token: SeRemoteShutdownPrivilege	2088	wmic.exe
Token: SeUndockPrivilege	2088	wmic.exe
Token: SeManageVolumePrivilege	2088	wmic.exe
Token: 33	2088	wmic.exe
Token: 34	2088	wmic.exe
Token: 35	2088	wmic.exe
Token: SeIncreaseQuotaPrivilege	2740	wmic.exe
Token: SeSecurityPrivilege	2740	wmic.exe
Token: SeTakeOwnershipPrivilege	2740	wmic.exe
Token: SeLoadDriverPrivilege	2740	wmic.exe
Token: SeSystemProfilePrivilege	2740	wmic.exe
Token: SeSystemtimePrivilege	2740	wmic.exe
Token: SeProfSingleProcessPrivilege	2740	wmic.exe
Token: SeIncBasePriorityPrivilege	2740	wmic.exe
Token: SeCreatePagefilePrivilege	2740	wmic.exe
Token: SeBackupPrivilege	2740	wmic.exe
Token: SeRestorePrivilege	2740	wmic.exe
Token: SeShutdownPrivilege	2740	wmic.exe
Token: SeDebugPrivilege	2740	wmic.exe
Token: SeSystemEnvironmentPrivilege	2740	wmic.exe
Token: SeRemoteShutdownPrivilege	2740	wmic.exe
Token: SeUndockPrivilege	2740	wmic.exe
Token: SeManageVolumePrivilege	2740	wmic.exe
Token: 33	2740	wmic.exe
Token: 34	2740	wmic.exe
Token: 35	2740	wmic.exe
Token: SeIncreaseQuotaPrivilege	2900	wmic.exe
Token: SeSecurityPrivilege	2900	wmic.exe
Token: SeTakeOwnershipPrivilege	2900	wmic.exe
Token: SeLoadDriverPrivilege	2900	wmic.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2416	2556	bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe	31
PID 2556 wrote to memory of 2416	2556	bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe	31
PID 2556 wrote to memory of 2416	2556	bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe	31
PID 2556 wrote to memory of 2416	2556	bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe	31
PID 2556 wrote to memory of 2416	2556	bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe	31
PID 2556 wrote to memory of 2416	2556	bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe	31
PID 2556 wrote to memory of 2416	2556	bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe	31
PID 2416 wrote to memory of 2088	2416	instract.exe	32
PID 2416 wrote to memory of 2088	2416	instract.exe	32
PID 2416 wrote to memory of 2088	2416	instract.exe	32
PID 2416 wrote to memory of 2088	2416	instract.exe	32
PID 2416 wrote to memory of 2740	2416	instract.exe	35
PID 2416 wrote to memory of 2740	2416	instract.exe	35
PID 2416 wrote to memory of 2740	2416	instract.exe	35
PID 2416 wrote to memory of 2740	2416	instract.exe	35
PID 2416 wrote to memory of 2900	2416	instract.exe	37
PID 2416 wrote to memory of 2900	2416	instract.exe	37
PID 2416 wrote to memory of 2900	2416	instract.exe	37
PID 2416 wrote to memory of 2900	2416	instract.exe	37
PID 2416 wrote to memory of 2728	2416	instract.exe	39
PID 2416 wrote to memory of 2728	2416	instract.exe	39
PID 2416 wrote to memory of 2728	2416	instract.exe	39
PID 2416 wrote to memory of 2728	2416	instract.exe	39
PID 2416 wrote to memory of 2756	2416	instract.exe	41
PID 2416 wrote to memory of 2756	2416	instract.exe	41
PID 2416 wrote to memory of 2756	2416	instract.exe	41
PID 2416 wrote to memory of 2756	2416	instract.exe	41
PID 2416 wrote to memory of 2648	2416	instract.exe	43
PID 2416 wrote to memory of 2648	2416	instract.exe	43
PID 2416 wrote to memory of 2648	2416	instract.exe	43
PID 2416 wrote to memory of 2648	2416	instract.exe	43

C:\Users\Admin\AppData\Local\Temp\bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bfe3e82de14df990b26a16f31bad8d0c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\instract.exe
  C:\Users\Admin\AppData\Local\Temp\instract.exe /PID=7302 /SUBPID=-1 /DISTID=11694 /NETWORKID=0 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=619605283 /D1=4672 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get serialnumber
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2728
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 360
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstC0E0.tmp\Convert.dll

Filesize
114KB

MD5
30c8f0661dad6c436dd8355637dd7251

SHA1
26fd4bb7738d9f2ef39e962827678320dc9aeaee

SHA256
919e737b57127fcf1127d17b61a382929a5cc1d83efe8f486a532628f9a583ea

SHA512
f4c4f756140dbfe778eb617a190817beb0dd45fdb1e0a18fe4c7adcc4c6901d1436fe6cdc109d3a261f431db9a86a8b2adc6626ccde7b5f0157e9c41c0d98ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\obhhelper.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\instract.exe

Filesize
1.3MB

MD5
a5a797794bada70c3eea4fc169cc28bf

SHA1
2fabd278b0e388a9dc7834ac9412dd94cac9f31e

SHA256
ef454f3e355e66480bb75433d9942babd9d594ff51df65a8ef0a3c0a2cd42e57

SHA512
47e214552737071c7fe23ca518a98ae59f0ed3aab041ddcf8977c1b2efcfde589af7502252c5bf9a43c9b3b7e6cb9ce21b3118ef8258685fb42abb9a760579a0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads