5fc2dc861530dda08b381a6c1eedd364460d9330b9e61162203b7e3c2010dc4d

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe
Size

84KB
MD5

ffd7ff50bb1c3cc91653b0572d28cc95
SHA1

34b5386be2550bc02d826c59e2dde117e9fa5db9
SHA256

5fc2dc861530dda08b381a6c1eedd364460d9330b9e61162203b7e3c2010dc4d
SHA512

01797b2ba2d4dcace2a78e68467d0d41e2c87bbfc4ba1de1e972ea425169648d3d33489e938b82ec9a403c6513350758d08eb6bc63486fd5c7ab09daf4949670
SSDEEP

1536:7gFqzQGTr0ZwwJBXjOIDtEZN4g5HzrSwX7QJ21fXFsqlIfSUJL8:X/TywwvXjd6ZigNzrRXUMFsq+S6L8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 208308cee612db01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B86A331-7EDA-11EF-8B3A-FE6EB537C9A6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433827913"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1056	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1056	iexplore.exe
1056	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 2328 wrote to memory of 1056	2328	ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe	31
PID 1056 wrote to memory of 3012	1056	iexplore.exe	32
PID 1056 wrote to memory of 3012	1056	iexplore.exe	32
PID 1056 wrote to memory of 3012	1056	iexplore.exe	32
PID 1056 wrote to memory of 3012	1056	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328
- C:\program files\internet explorer\iexplore.exe
  "C:\program files\internet explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\ffd7ff50bb1c3cc91653b0572d28cc95_JaffaCakes118.exe"
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1056 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fff006c7aaad35d80731a6e77801f6a6

SHA1
74a174f8220fbb8203f25e0b455b2c799daef1ba

SHA256
93a2a2b3702ba1a280508eb73cdde2df4dc0e8241ef653a91e451aa0b743de55

SHA512
001a25a2d8d0247a3dee423fbc1304c91eca0ae3bf1f3ba00c8245066406bd3c6519b7a5a592636e7772246d09a9906a90ee87608a3e9947a9f89d8743af5a47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc4df7cfcebd7919e3a6f7c4950ecd28

SHA1
0b87dcd2f3f31aa009163437d48941cee6c39cfd

SHA256
850fb2c25dcece5017ae7ca80819a0752f74bd53844c86189ec002999f278d25

SHA512
921966bdb6f7635219fcaa8ba60be8a73bb2a5662df93477305f796642899539e0289a28c4de6091f3bf9d174f64d4253734243d74c50504076a1149c1185dd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
916010f3162c21ec8aea603b3c4fdd33

SHA1
baeb00eedb5cf113c5459fba4a9f1c62d8282ae9

SHA256
64cce68fbe01bc1f4a08971f910dac3951dd82a362eae97382491d1539b0e307

SHA512
be9b19dadc82eaa13404a1e36cbe5461a78e9461fe16cced20aaafb6150757db60c085439c662be967572858c7502bfd87c10a82eb570bed0a9362f05ffbc1a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3731dd73ae3252adbf8c3421f1499b4c

SHA1
16bf85e8ac28b00c97d0706c82c86bd7a169ea0c

SHA256
56c333bb27aef84d25f878da36d6e66e78207b44feee216f58d73cd5dd51ff6b

SHA512
9050903b27834d6348d10457e1abf2f1462342133b9a9afa340b1a8ee57e8f3d55bcc8d82042ef9b0fa96f8ec4be5866b45fd20672c41be2d58aa28d1a7d38d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2635b39df0351cf98dfff17564770b09

SHA1
3676f82325a2bfe509c063c56a8341c6d458585e

SHA256
8b632bce7f2977c023c9f004004f673013aa9fb4204a79f8ba53c12e7cc70d8f

SHA512
94b5088b77ccbfce638e22cd0420d4936544b624a3d454bdc5525cb39d3468bdaf3f87a28fd55fa204b4ab4f441e136590bff4fb2d7724c4b0e98d604d6840c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
867f545afd92ff3537b22b1522f1790c

SHA1
4349ec4b4aadd12e34a5677a9b5436f43c22ed77

SHA256
e54dd8cae1297300960dae50122c1210601c4e9223dab0e407d31a00cdcc724a

SHA512
15368aa77b6b59495863b55f44ec520f00399c4ebb4bbac515a5f303970ff521a16be14dd511e9f0754f1defd0ff816aa81bb201cf6fd8ddd3cacbda1fb3d4e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7f6de8dacd9cd255bd396aeed38d304

SHA1
3811fd94ae0e44cbf0c403c4adff711d796d69d1

SHA256
ffc880ead153eac1c79e18d91836b405a50ac7d7c2cd6c17ad2cc4c7d16ad181

SHA512
258b555f6636d2431cf0d86ec287d0a907faac2a29c068f1584491319b2ecede346ee0047f85bc1b12cd96f950e66a8b4b5c87fe091fdf33dbf6f37b23bfff43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bacc9d23406e4f78b0486ffa91c8114

SHA1
64ee6fc3ab1a3679cfb135f4ec28e4913c0747ff

SHA256
4b6e7e71f3c523de7416c20f3c5104b2681c49ded4806153900961af13981d47

SHA512
6b6124f306416a82883f8c4258e5d0c11b15e6a14a8ac4ff3c7c03d9d734d53201c46c16e8658cf8af39d9fecac89bccbbf5937b6f06a77de7cb791fb199707b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5479bcfb5a0cbdd4d232ceb646a5dac

SHA1
423dfe36ba212bcd30c9d5c4708d1c7606704532

SHA256
e77d2adb7739077a6c753b0ef4c61b56b8d077b7cde65c47bb86d7b7995bd305

SHA512
403c874d8de4938a002b84b4f60097a2f82d3ece47eb6dd6733ee76034b996aaefdd0200cf86abb93e9390bc20fe4f675ea0712a9a898eaaec1614f6d93274a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE1C9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE239.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2328-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads