ae0a1c7d701a41d02532e1ce8f716a8b6bd5c92567f39c278fcf9f22209a1d5f

Analysis

max time kernel
121s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe
Size

68KB
MD5

fb6e350ac1be86bc7d38fcc3539df44e
SHA1

6a393ffff69881c201075137a78c5a1b046e3632
SHA256

ae0a1c7d701a41d02532e1ce8f716a8b6bd5c92567f39c278fcf9f22209a1d5f
SHA512

f7a8522039a4f511f52c3b8bae601df4f9af02cdac709bb9f15cab2b39bf3fcc74052af6f2116cf4761c3b63a625cf33027e9c7a4805689ef31de9d108f619c4
SSDEEP

768:lq19X3jo7NUcM3IGDuPbAjvxGMO+gd2yQSiGDiB97z8gTf8AImwS+rW6u6i63:lqDo7Nm6JMOZYyjyV87S8WG

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSOffice = "C:\\Windows\\system32\\MSOffice\\services.exe"	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\yyhcvdei.exe	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MSOffice\services.exe	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSOffice\services.exe	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Uninstall Flag = "1"	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3612	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe
3612	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe
3612	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe
3612	fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb6e350ac1be86bc7d38fcc3539df44e_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\yyhcvdei.exe

Filesize
8KB

MD5
474db25a43a5d0b6291c67e674ace7c2

SHA1
1b758e542cb61b944629dc1e8e4032467d204458

SHA256
b0930134a18fe9d1124cf140829f2759d4de8352e9628a461e8b93b10b402878

SHA512
9d321e86590d76194a64fb5573070957a700591d977b2398c0884bcfa6ac81825a92d94894cfc3d20f3007c21d4e4ae01412679c191ad361f78e7af3f17b67bc

Download Submit