Analysis
-
max time kernel
94s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 01:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe
-
Size
204KB
-
MD5
db92cadd257d61ec0705c5481be53432
-
SHA1
d20465e0b61110761a59524edd6021a83f06624c
-
SHA256
8e7a9f89838c01a9a13b868e34661903a771adce61aca6cdd109239e55ee00ed
-
SHA512
c1ea7685c1084b55261e08b14b6985dab8aa4112d75af629b0cbd4973ab7e36cd5e0658e60cc0474409c752f6b5831e492d355591cbb98a454e481d6ae775a53
-
SSDEEP
3072:NYtkwP3n3j4oNx0iJKmmzuVaVvOTwl/lAwSLRjhRx/hru2+44H7PhC6I:NY+wP3nJql/uNRjhR7d+441
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,19041,1266" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C} db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\Version = "12,0,19041,1266" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,19041,1266" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}\Version = "12,0,19041,1266" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\ db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\Version = "12,0,19041,1266" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\ = "Microsoft Windows Media Player 12.0" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C} db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}\Version = "12,0,19041,1266" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\wmsetup.log db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.m3u db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{33FACFE0-A9BE-11d0-A520-00A0D10129C0 db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MMSU\Animation = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSBD db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.asf = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.asp = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wm = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wvx = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wmafile\shellex\ContextMenuHandlers\WMPBurnAudioCD db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shellex\ContextMenuHandlers\WMPBurnAudioCD\ = "{8DD448E6-C188-4aed-AF92-44956194EB1F}" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wmv = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.asf db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.asf\Animation = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wma = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wmafile\shellex\ContextMenuHandlers db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.WMDBFile\DefaultIcon db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wvx db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wma\Animation = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wm\Animation = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wax\Animation = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wmafile\shellex db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.asx\Animation = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\RIFFHandlers\WAVE db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wax db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmv db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.nsc = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions\AVI db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Compressors\auds db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.WMDBFile\FriendlyTypeName = "@C:\\Windows\\inf\\unregmp2.exe,-9924" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.WMDBFile\DefaultIcon\ = "C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe,-120" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MMSU db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.wax = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shellex\ContextMenuHandlers db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.WMDBFile db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\RIFFHandlers db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.m3u\SubType = "{a98c8400-4181-11d1-a520-00a0d10129c0}" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wmdb db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSBD\Animation = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wma db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions\AU db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MMS db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MMS\Animation = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmv\Animation = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wmx db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shellex db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.dvr-ms\Media Type = "{e436eb83-524f-11ce-9f53-0020af0ba770}" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions\WAV db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.m3u\Source Filter = "{e436ebb5-524f-11ce-9f53-0020af0ba770}" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.dvr-ms\SubType = "{e06d8023-db46-11cf-b4d1-00805f6cbbea}" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{33FACFE0-A9BE-11d0-A520-00A0D10129C0\0 = "0,4,ffdfdfdf,3C53414d" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.asx db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.wm db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shellex\ContextMenuHandlers\WMPBurnAudioCD db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.WMDBFile\ = "Windows Media Library" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MMST\Animation = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\AnimExtensions\.asx = "dxmasf.dll,150" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.WMDBFile\NoOpen db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wmdb\ = "WMP.WMDBFile" db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MMST db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wmafile db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{083863F1-70DE-11d0-BD40-00A0C911CE86} db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\db92cadd257d61ec0705c5481be53432_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:3676