881b6cfac026b21fb16d440f2239ccc8200c81c756ebcf334ba6f4b325f019a2

Analysis

max time kernel
147s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Size

361KB
MD5

c8551819944aa0b42b404e8a57696f99
SHA1

991636fbefc638a505a2bc408a5417b02e6b1886
SHA256

881b6cfac026b21fb16d440f2239ccc8200c81c756ebcf334ba6f4b325f019a2
SHA512

7b84e9a2495f0a9e4dc7845b080d7e3f3685884b801fe39c62f4862ba8954b79a14c3e015ce17b21f9f6f5a63f7f1d86530b35eee57bea12d1907aef0e12906e
SSDEEP

6144:nqhMPkbj8olritKpGmgXIaik9gvrmQGfMcIZnpYAHIe+cg/fp:uEKGLXIJkwrmrrIZpYAHnk

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	wvcv.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wvcv.exe

Executes dropped EXE 2 IoCs

pid	Process
2160	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
2752	wvcv.exe

Loads dropped DLL 5 IoCs

pid	Process
2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
2752	wvcv.exe
2752	wvcv.exe
2752	wvcv.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	wvcv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	wvcv.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	wvcv.exe
File opened (read-only)	\??\U:	wvcv.exe
File opened (read-only)	\??\X:	wvcv.exe
File opened (read-only)	\??\I:	wvcv.exe
File opened (read-only)	\??\P:	wvcv.exe
File opened (read-only)	\??\V:	wvcv.exe
File opened (read-only)	\??\Y:	wvcv.exe
File opened (read-only)	\??\Z:	wvcv.exe
File opened (read-only)	\??\E:	wvcv.exe
File opened (read-only)	\??\J:	wvcv.exe
File opened (read-only)	\??\L:	wvcv.exe
File opened (read-only)	\??\M:	wvcv.exe
File opened (read-only)	\??\N:	wvcv.exe
File opened (read-only)	\??\Q:	wvcv.exe
File opened (read-only)	\??\T:	wvcv.exe
File opened (read-only)	\??\B:	wvcv.exe
File opened (read-only)	\??\H:	wvcv.exe
File opened (read-only)	\??\O:	wvcv.exe
File opened (read-only)	\??\R:	wvcv.exe
File opened (read-only)	\??\S:	wvcv.exe
File opened (read-only)	\??\W:	wvcv.exe
File opened (read-only)	\??\G:	wvcv.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	wvcv.exe
File created	\??\c:\windows\SysWOW64\maxtrox.txt	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	wvcv.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	wvcv.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	wvcv.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\private_browsing.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	wvcv.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	wvcv.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wvcv.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	wvcv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	wvcv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	wvcv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	wvcv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	wvcv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	wvcv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	wvcv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	wvcv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	wvcv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	wvcv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	wvcv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	wvcv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	wvcv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	wvcv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	wvcv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	wvcv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
2752	wvcv.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2160	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2160	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2160	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2160	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2160	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2160	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2160	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2752	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2752	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2752	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2752	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2752	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2752	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2752	2916	c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2160
- \??\c:\Documents and Settings\Admin\Application Data\Microsoft\wvcv.exe
  "c:\Documents and Settings\Admin\Application Data\Microsoft\wvcv.exe" c8551819944aa0b42b404e8a57696f99_JaffaCakes118
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Windows 3D.scr

Filesize
76KB

MD5
9dfa18597238a85ef005afea97ed0b57

SHA1
5b9e8405052dc036b8bcadf7c875932afa4e711c

SHA256
edd79738ddc66f96acb3139754f775ab100cf7fb5c6a77da1b74ab0531d4b5e9

SHA512
62b62ed2b510f9a5d838b8eaba1ac0c879a3bb21b05bd557e9a95ae01665572c20c057f813d26abc65306696624636e2b2fda7b3a30d0bf515ef1514f9e55d15

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Local\Temp\c8551819944aa0b42b404e8a57696f99_JaffaCakes118.exe

Filesize
288KB

MD5
e5f457e3d89281b97b099a757b4d9577

SHA1
aa8a49a5cfff30f5cdd23a7659b1c3ecdc734711

SHA256
ebcfea076a3bdca680525b5ce11e7d918cf574f800971a4ddd081f5a6069f0b8

SHA512
ffbb2880e10084c187a8dd3c42198782bc50a24886b2a8ee523b4c70a2dbb0b46ee1aa799f44bdd5129935d9d12b3c09e9566278b2f088ede8a39c6ec203663e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\wvcv.exe

Filesize
76KB

MD5
7a65fc3a05bc34e2608f2dc781494803

SHA1
501ff02120b10bd74fd1f4ebab71b9bb2884e252

SHA256
8f07e447d5230f5012f10ce0f7f614a38ce3902ac8b702ac28292e39dc904ed4

SHA512
a7917e12ec09e4a500d41e346666bb124d428789265af5891037395cbe463ab547d87ff0ea8b40c0315cdd7d5105dc56049f2a813142c88b80e561878e525315

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads