d8f027de01d835c1ebc363a2465fc2642658504b5383745848753ca8c5ba1fba

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe
Size

364KB
MD5

ce2acdfb099d03ca2d628bf4fde7af77
SHA1

57e98da2bfba556260fafee21337d8d89bbf7000
SHA256

d8f027de01d835c1ebc363a2465fc2642658504b5383745848753ca8c5ba1fba
SHA512

2f2dfd841b94bf51e10c4cbd66a750b293e2635fa78886d0024e39f75eb82e27dc1736c4f5664553b2719d6919dde5b3645c24f9dc27f9b8759e23a266355f2e
SSDEEP

6144:ibCdhkyzFFbIX0zE9NKFEWNFfK4CS0NwIg2+fFBFFrkiEw:imdKWbIXxcXNkjNgZf1Fr5

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2628	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2792	enab.exe

Loads dropped DLL 2 IoCs

pid	Process
1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe
1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\{ED60B7C8-3C80-AD4F-2955-D827011AFB3A} = "C:\\Users\\Admin\\AppData\\Roaming\\Juvyw\\enab.exe"	enab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1364 set thread context of 2628	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	enab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Privacy	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe
2792	enab.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe
2792	enab.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2792	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	30
PID 1364 wrote to memory of 2792	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	30
PID 1364 wrote to memory of 2792	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	30
PID 1364 wrote to memory of 2792	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	30
PID 2792 wrote to memory of 1120	2792	enab.exe	19
PID 2792 wrote to memory of 1120	2792	enab.exe	19
PID 2792 wrote to memory of 1120	2792	enab.exe	19
PID 2792 wrote to memory of 1120	2792	enab.exe	19
PID 2792 wrote to memory of 1120	2792	enab.exe	19
PID 2792 wrote to memory of 1192	2792	enab.exe	20
PID 2792 wrote to memory of 1192	2792	enab.exe	20
PID 2792 wrote to memory of 1192	2792	enab.exe	20
PID 2792 wrote to memory of 1192	2792	enab.exe	20
PID 2792 wrote to memory of 1192	2792	enab.exe	20
PID 2792 wrote to memory of 1252	2792	enab.exe	21
PID 2792 wrote to memory of 1252	2792	enab.exe	21
PID 2792 wrote to memory of 1252	2792	enab.exe	21
PID 2792 wrote to memory of 1252	2792	enab.exe	21
PID 2792 wrote to memory of 1252	2792	enab.exe	21
PID 2792 wrote to memory of 1612	2792	enab.exe	25
PID 2792 wrote to memory of 1612	2792	enab.exe	25
PID 2792 wrote to memory of 1612	2792	enab.exe	25
PID 2792 wrote to memory of 1612	2792	enab.exe	25
PID 2792 wrote to memory of 1612	2792	enab.exe	25
PID 2792 wrote to memory of 1364	2792	enab.exe	29
PID 2792 wrote to memory of 1364	2792	enab.exe	29
PID 2792 wrote to memory of 1364	2792	enab.exe	29
PID 2792 wrote to memory of 1364	2792	enab.exe	29
PID 2792 wrote to memory of 1364	2792	enab.exe	29
PID 1364 wrote to memory of 2628	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	31
PID 1364 wrote to memory of 2628	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	31
PID 1364 wrote to memory of 2628	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	31
PID 1364 wrote to memory of 2628	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	31
PID 1364 wrote to memory of 2628	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	31
PID 1364 wrote to memory of 2628	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	31
PID 1364 wrote to memory of 2628	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	31
PID 1364 wrote to memory of 2628	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	31
PID 1364 wrote to memory of 2628	1364	ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe	31

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1192

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252
- C:\Users\Admin\AppData\Local\Temp\ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Users\Admin\AppData\Roaming\Juvyw\enab.exe
    "C:\Users\Admin\AppData\Roaming\Juvyw\enab.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp61c4be07.bat"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2628

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp61c4be07.bat

Filesize
271B

MD5
50bbc72b7b3d18ba777c5119a31228fe

SHA1
39960342032ce247e20d7521b87e00adc6856a50

SHA256
0fe8cd343450e96a46b4b3cd6d0fea1f9bb5924dd6f870bd76f073cf7a7251ac

SHA512
c2f3f60efeac62b11bc15313841972553f18b23dace539844507457d94b519f31525b66c4bc3cdb1e2b5edefb8c6286c0d05bd2d88e87f7d19688d287426f52f

Download Submit
\Users\Admin\AppData\Roaming\Juvyw\enab.exe

Filesize
364KB

MD5
3bf4dda0c2e108e1429fb377c608ae5a

SHA1
f3f4c3a902b9ab52cf10ddd62aca02a814af5d47

SHA256
bd1b59357b60464cbe11c53bba78a95dfc9e4c1d7d598f459cfcc40e78397ee9

SHA512
4af30f06ea5904133042d8b98809113cefe9aad7c331a8f87b328fd267923419fd5b63d9a1db5272e69d38815359fee9865d76f248e9b25c9ee7c11f0aac6184

Download Submit
memory/1120-19-0x0000000001CD0000-0x0000000001D14000-memory.dmp

Filesize
272KB

Download
memory/1120-20-0x0000000001CD0000-0x0000000001D14000-memory.dmp

Filesize
272KB

Download
memory/1120-21-0x0000000001CD0000-0x0000000001D14000-memory.dmp

Filesize
272KB

Download
memory/1120-22-0x0000000001CD0000-0x0000000001D14000-memory.dmp

Filesize
272KB

Download
memory/1120-23-0x0000000001CD0000-0x0000000001D14000-memory.dmp

Filesize
272KB

Download
memory/1192-25-0x0000000000120000-0x0000000000164000-memory.dmp

Filesize
272KB

Download
memory/1192-26-0x0000000000120000-0x0000000000164000-memory.dmp

Filesize
272KB

Download
memory/1192-27-0x0000000000120000-0x0000000000164000-memory.dmp

Filesize
272KB

Download
memory/1192-28-0x0000000000120000-0x0000000000164000-memory.dmp

Filesize
272KB

Download
memory/1252-31-0x00000000028F0000-0x0000000002934000-memory.dmp

Filesize
272KB

Download
memory/1252-33-0x00000000028F0000-0x0000000002934000-memory.dmp

Filesize
272KB

Download
memory/1252-32-0x00000000028F0000-0x0000000002934000-memory.dmp

Filesize
272KB

Download
memory/1252-30-0x00000000028F0000-0x0000000002934000-memory.dmp

Filesize
272KB

Download
memory/1364-79-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-40-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/1364-73-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-71-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-134-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-133-0x00000000002E0000-0x000000000033C000-memory.dmp

Filesize
368KB

Download
memory/1364-69-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-67-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-65-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-61-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-59-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-57-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-55-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-53-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-51-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-49-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-47-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-45-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-43-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/1364-42-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/1364-41-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/1364-75-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-1-0x00000000002E0000-0x000000000033C000-memory.dmp

Filesize
368KB

Download
memory/1364-157-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1364-158-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/1364-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1364-77-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-0-0x0000000000290000-0x00000000002D4000-memory.dmp

Filesize
272KB

Download
memory/1364-131-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/1364-132-0x0000000077B70000-0x0000000077B71000-memory.dmp

Filesize
4KB

Download
memory/1364-63-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1364-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1364-4-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1364-44-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/1364-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1612-35-0x0000000001F90000-0x0000000001FD4000-memory.dmp

Filesize
272KB

Download
memory/1612-36-0x0000000001F90000-0x0000000001FD4000-memory.dmp

Filesize
272KB

Download
memory/1612-37-0x0000000001F90000-0x0000000001FD4000-memory.dmp

Filesize
272KB

Download
memory/1612-38-0x0000000001F90000-0x0000000001FD4000-memory.dmp

Filesize
272KB

Download
memory/2792-15-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2792-17-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2792-16-0x0000000000360000-0x00000000003BC000-memory.dmp

Filesize
368KB

Download
memory/2792-280-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2792-281-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download