3c6d439128b0a58026039ea8988300be3082bdc6a8d556c50d73c7e8383fe19a

Analysis

max time kernel
83s
max time network
84s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Size

52KB
MD5

d3468c9c0096529489b3cb0276b7bdd3
SHA1

a5734118be6f1a49d59a503003669c78dfc32951
SHA256

3c6d439128b0a58026039ea8988300be3082bdc6a8d556c50d73c7e8383fe19a
SHA512

ac64f792b06ca169781ae5b40041a96469ca06b8b8b3e61fc08ce30ac925e14f93f9f36c870d37fcc41b70122d31e1bfb3feb341f814a52b63485df0a9ecc140
SSDEEP

768:ybk8iuYpeHor+te5MZRNtlas+v9eLF1Srg:yALS5tivqa

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\BandRest = "Never"	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Start Page_bak = "http://go.microsoft.com/fwlink/?LinkId=69157"	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://www.couldnotfind.com/search_page.html?&account_id=131567"	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Search Page_bak = "http://go.microsoft.com/fwlink/?LinkId=54896"	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.couldnotfind.com/search_page.html?&account_id=131567"	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\BandRest = "Never"	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Use Search Assistant = "no"	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Search	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Search\SearchAssistant = "http://www.couldnotfind.com/search_page.html?&account_id=131567"	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.slotch.com/?&account_id=131567"	d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d3468c9c0096529489b3cb0276b7bdd3_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads