0d300e405486d24ff5910d1f9b29f88bcb5425ac559634dcbaed6e2fcfeba551

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Size

72KB
MD5

dba1f8deb38b39cc6fb08a8633de1ee2
SHA1

89989411515c1e469f017b9b721f9bea302d7cd4
SHA256

0d300e405486d24ff5910d1f9b29f88bcb5425ac559634dcbaed6e2fcfeba551
SHA512

3cee0ef1f7636b74f2450b0678a03ad3d63f29460a48b41270e6aa4fde7d1eb2c19e831b1e0d3dbbad48d99cbe7d67bf0d65b9ca071871dc03f72cf209252138
SSDEEP

1536:iFBfsS24ZlDQ+j8jjE+OzUaQ+MpDS6QsQ+wQ++Q+VOZL:iFBfsSZZOrh1SlHaYIM

Score

10^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "file:\\\\C:\\sys.exe"	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\qx1.bat	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\ie.bat	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4140	cmd.exe
4520	cmd.exe
4864	cmd.exe
4820	cmd.exe
4920	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://hao.greenhome001.com.cn"	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.exe"	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\shell\open\command	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\shell\open	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.exe http://hao.greenhome001.com.cn"	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "Internet Explorer"	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\NeverShowExt = "1"	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\DefaultIcon	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\shell	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4920	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	86
PID 5004 wrote to memory of 4920	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	86
PID 5004 wrote to memory of 4920	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	86
PID 4920 wrote to memory of 1536	4920	cmd.exe	88
PID 4920 wrote to memory of 1536	4920	cmd.exe	88
PID 4920 wrote to memory of 1536	4920	cmd.exe	88
PID 5004 wrote to memory of 4140	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	89
PID 5004 wrote to memory of 4140	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	89
PID 5004 wrote to memory of 4140	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	89
PID 4140 wrote to memory of 2976	4140	cmd.exe	91
PID 4140 wrote to memory of 2976	4140	cmd.exe	91
PID 4140 wrote to memory of 2976	4140	cmd.exe	91
PID 5004 wrote to memory of 4520	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	92
PID 5004 wrote to memory of 4520	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	92
PID 5004 wrote to memory of 4520	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	92
PID 4520 wrote to memory of 4636	4520	cmd.exe	94
PID 4520 wrote to memory of 4636	4520	cmd.exe	94
PID 4520 wrote to memory of 4636	4520	cmd.exe	94
PID 5004 wrote to memory of 4864	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	95
PID 5004 wrote to memory of 4864	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	95
PID 5004 wrote to memory of 4864	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	95
PID 4864 wrote to memory of 2840	4864	cmd.exe	97
PID 4864 wrote to memory of 2840	4864	cmd.exe	97
PID 4864 wrote to memory of 2840	4864	cmd.exe	97
PID 5004 wrote to memory of 4820	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	98
PID 5004 wrote to memory of 4820	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	98
PID 5004 wrote to memory of 4820	5004	dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe	98
PID 4820 wrote to memory of 2584	4820	cmd.exe	100
PID 4820 wrote to memory of 2584	4820	cmd.exe	100
PID 4820 wrote to memory of 2584	4820	cmd.exe	100

Views/modifies file attributes 1 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2976	attrib.exe
4636	attrib.exe
2840	attrib.exe
2584	attrib.exe
1536	attrib.exe

C:\Users\Admin\AppData\Local\Temp\dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dba1f8deb38b39cc6fb08a8633de1ee2_JaffaCakes118.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2584