10a49cc4e707c30a78e900e2131246cd51099d3dcde5afb0d4de9ef02f47eaee

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe
Size

621KB
MD5

ea7a8e76423fba0b5537746e8711f1e5
SHA1

7affcc5fb2c9af8fd92dd59502c399826aad3b4f
SHA256

10a49cc4e707c30a78e900e2131246cd51099d3dcde5afb0d4de9ef02f47eaee
SHA512

fb35ad25d053eea34b3fbcc3c5e4cd220d9cfd25cc805bee7b5c3873637400be09e53cb7916f94d5387eb2093aa371e3d957724d9be88f57f00c7469bab07116
SSDEEP

12288:Fnun2aeU5rYC3nvM3/jj8KNuwEBXnQmqgsBb2DwWgfc8vy4hh:Fu2D6nk3f8KNulkyDwA86I

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2708	irdms.exe

Loads dropped DLL 10 IoCs

pid	Process
2364	ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe
2364	ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe
2364	ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	2708	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irdms.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2708	irdms.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS\ = "0"	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0"	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\ = "SmartInstallerLib"	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version\ = "1.0"	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals"	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\irdms.exe\""	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\ = "CBrowserExternal Class"	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\irdms.exe"	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0"	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Programmable	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals"	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\irdms.exe"	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}	irdms.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"	irdms.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32	irdms.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2804	wmic.exe
Token: SeSecurityPrivilege	2804	wmic.exe
Token: SeTakeOwnershipPrivilege	2804	wmic.exe
Token: SeLoadDriverPrivilege	2804	wmic.exe
Token: SeSystemProfilePrivilege	2804	wmic.exe
Token: SeSystemtimePrivilege	2804	wmic.exe
Token: SeProfSingleProcessPrivilege	2804	wmic.exe
Token: SeIncBasePriorityPrivilege	2804	wmic.exe
Token: SeCreatePagefilePrivilege	2804	wmic.exe
Token: SeBackupPrivilege	2804	wmic.exe
Token: SeRestorePrivilege	2804	wmic.exe
Token: SeShutdownPrivilege	2804	wmic.exe
Token: SeDebugPrivilege	2804	wmic.exe
Token: SeSystemEnvironmentPrivilege	2804	wmic.exe
Token: SeRemoteShutdownPrivilege	2804	wmic.exe
Token: SeUndockPrivilege	2804	wmic.exe
Token: SeManageVolumePrivilege	2804	wmic.exe
Token: 33	2804	wmic.exe
Token: 34	2804	wmic.exe
Token: 35	2804	wmic.exe
Token: SeIncreaseQuotaPrivilege	2804	wmic.exe
Token: SeSecurityPrivilege	2804	wmic.exe
Token: SeTakeOwnershipPrivilege	2804	wmic.exe
Token: SeLoadDriverPrivilege	2804	wmic.exe
Token: SeSystemProfilePrivilege	2804	wmic.exe
Token: SeSystemtimePrivilege	2804	wmic.exe
Token: SeProfSingleProcessPrivilege	2804	wmic.exe
Token: SeIncBasePriorityPrivilege	2804	wmic.exe
Token: SeCreatePagefilePrivilege	2804	wmic.exe
Token: SeBackupPrivilege	2804	wmic.exe
Token: SeRestorePrivilege	2804	wmic.exe
Token: SeShutdownPrivilege	2804	wmic.exe
Token: SeDebugPrivilege	2804	wmic.exe
Token: SeSystemEnvironmentPrivilege	2804	wmic.exe
Token: SeRemoteShutdownPrivilege	2804	wmic.exe
Token: SeUndockPrivilege	2804	wmic.exe
Token: SeManageVolumePrivilege	2804	wmic.exe
Token: 33	2804	wmic.exe
Token: 34	2804	wmic.exe
Token: 35	2804	wmic.exe
Token: SeIncreaseQuotaPrivilege	2768	wmic.exe
Token: SeSecurityPrivilege	2768	wmic.exe
Token: SeTakeOwnershipPrivilege	2768	wmic.exe
Token: SeLoadDriverPrivilege	2768	wmic.exe
Token: SeSystemProfilePrivilege	2768	wmic.exe
Token: SeSystemtimePrivilege	2768	wmic.exe
Token: SeProfSingleProcessPrivilege	2768	wmic.exe
Token: SeIncBasePriorityPrivilege	2768	wmic.exe
Token: SeCreatePagefilePrivilege	2768	wmic.exe
Token: SeBackupPrivilege	2768	wmic.exe
Token: SeRestorePrivilege	2768	wmic.exe
Token: SeShutdownPrivilege	2768	wmic.exe
Token: SeDebugPrivilege	2768	wmic.exe
Token: SeSystemEnvironmentPrivilege	2768	wmic.exe
Token: SeRemoteShutdownPrivilege	2768	wmic.exe
Token: SeUndockPrivilege	2768	wmic.exe
Token: SeManageVolumePrivilege	2768	wmic.exe
Token: 33	2768	wmic.exe
Token: 34	2768	wmic.exe
Token: 35	2768	wmic.exe
Token: SeIncreaseQuotaPrivilege	2812	wmic.exe
Token: SeSecurityPrivilege	2812	wmic.exe
Token: SeTakeOwnershipPrivilege	2812	wmic.exe
Token: SeLoadDriverPrivilege	2812	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2708	2364	ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2708	2364	ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2708	2364	ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2708	2364	ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2804	2708	irdms.exe	31
PID 2708 wrote to memory of 2804	2708	irdms.exe	31
PID 2708 wrote to memory of 2804	2708	irdms.exe	31
PID 2708 wrote to memory of 2804	2708	irdms.exe	31
PID 2708 wrote to memory of 2768	2708	irdms.exe	34
PID 2708 wrote to memory of 2768	2708	irdms.exe	34
PID 2708 wrote to memory of 2768	2708	irdms.exe	34
PID 2708 wrote to memory of 2768	2708	irdms.exe	34
PID 2708 wrote to memory of 2812	2708	irdms.exe	36
PID 2708 wrote to memory of 2812	2708	irdms.exe	36
PID 2708 wrote to memory of 2812	2708	irdms.exe	36
PID 2708 wrote to memory of 2812	2708	irdms.exe	36
PID 2708 wrote to memory of 2912	2708	irdms.exe	38
PID 2708 wrote to memory of 2912	2708	irdms.exe	38
PID 2708 wrote to memory of 2912	2708	irdms.exe	38
PID 2708 wrote to memory of 2912	2708	irdms.exe	38
PID 2708 wrote to memory of 2668	2708	irdms.exe	40
PID 2708 wrote to memory of 2668	2708	irdms.exe	40
PID 2708 wrote to memory of 2668	2708	irdms.exe	40
PID 2708 wrote to memory of 2668	2708	irdms.exe	40
PID 2708 wrote to memory of 2700	2708	irdms.exe	42
PID 2708 wrote to memory of 2700	2708	irdms.exe	42
PID 2708 wrote to memory of 2700	2708	irdms.exe	42
PID 2708 wrote to memory of 2700	2708	irdms.exe	42

C:\Users\Admin\AppData\Local\Temp\ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea7a8e76423fba0b5537746e8711f1e5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\irdms.exe
  C:\Users\Admin\AppData\Local\Temp\irdms.exe /PID=3022 /SUBPID=0 /NETWORKID=0 /DISTID=9180 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=Z4dXVpZD05ODViYWVhZS00ZDA5LTQ4YWUtOTk0NS1hZWZhMmIzYjg4OGM /D1=1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=5 /THANKYOU_URL= /TIME=1408064526 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\91726715591.txt bios get serialnumber
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\91726715591.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\91726715591.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\91726715591.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2912
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\91726715591.txt bios get version
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 368
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\91726715591.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\irdms.exe

Filesize
797KB

MD5
ab81555ba1fdbc6b251c21df5a10b147

SHA1
4c1f76586e96dcb55060168d6baa05b8386d04eb

SHA256
2e949a42fda02b0617497d487c44d38a8a1ea65450077f2b40d237769cb62021

SHA512
4fae12ec5131c78b4c268dc308303951fe7d74a9e31f9b15be6b7957a33723a9cb9bd13b309acf3ce4c706507109d6029d0cfa32ce01f5ed75f5e50643bed562

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoA729.tmp\Convert.dll

Filesize
114KB

MD5
4db8ca6c6568b2ff6bddb0a69b9199cf

SHA1
58fe11a5ac98f4310a1c37a8b3824858d2523a82

SHA256
dbd3ecd6e4aaff32a30d871df07fa3e69471622154b670ee37191e9767431f2c

SHA512
53a430b37697d046e74d53dc92d96bcb0af77753dff7f470a1030684da8270640f190ce4e1529672190d5a4b60dab9730c393716188dad34b846822c4ff0c89a

Download Submit
\Users\Admin\AppData\Local\Temp\nsoA729.tmp\ZipDLL.dll

Filesize
163KB

MD5
2dc35ddcabcb2b24919b9afae4ec3091

SHA1
9eeed33c3abc656353a7ebd1c66af38cccadd939

SHA256
6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

SHA512
0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads