Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
00396e4da96a97766313a548570b5d35_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00396e4da96a97766313a548570b5d35_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
00396e4da96a97766313a548570b5d35_JaffaCakes118.exe
-
Size
91KB
-
MD5
00396e4da96a97766313a548570b5d35
-
SHA1
a04ca242e2cf71dee431ccd809e943404a5a1e1a
-
SHA256
274788c12871c80676d9f04190bfc3f551952dbe8f32fb7459dff1138fdcecad
-
SHA512
97eec73a60fdbfd5075f615c1a3e22745712a3d1a8394ea0aa774c7525ab2f70a813633f2e5c2976390fd0eb67690655eb66ff6546295fecbbdd2313e9a82a90
-
SSDEEP
1536:BpzdwtSeLldxi4DV3KkYgurpMg1rfzH1fI/Y4OPzb4r9Y56iHVCc:BpzaLiuFKXXr11rfzH2/OPv4rirYc
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3676 urdvxc.exe -
Executes dropped EXE 5 IoCs
pid Process 4820 urdvxc.exe 2916 urdvxc.exe 2464 urdvxc.exe 3676 urdvxc.exe 1780 urdvxc.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe -
Drops file in Program Files directory 27 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html urdvxc.exe File opened for modification C:\Program Files\DisableGroup.mhtml urdvxc.exe File opened for modification C:\Program Files\DisableGroup.mhtml urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language urdvxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language urdvxc.exe -
Modifies registry class 44 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bkkwksrntkekrzez" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "nnltbtqhnjlhnklk" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C82E1E0-C32C-9B88-1257-AE328B78FB1A} 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C82E1E0-C32C-9B88-1257-AE328B78FB1A}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\00396e4da96a97766313a548570b5d35_JaffaCakes118.exe" 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "trbhlnxrqrerjhse" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C82E1E0-C32C-9B88-1257-AE328B78FB1A}\ = "bhnsnhxvtzkhkenj" 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nnwbzbblswtneckq" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "jttrnnehbsnqebrt" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C82E1E0-C32C-9B88-1257-AE328B78FB1A}\LocalServer32 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "hxsnxhhhhklcbqel" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "nbsrwntclxrjqbjz" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ntcnexltbnkjsjlz" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "rbnbbsrelxvnlezw" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "bbehrxqnskwvsszt" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4820 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 740 wrote to memory of 4820 740 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe 89 PID 740 wrote to memory of 4820 740 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe 89 PID 740 wrote to memory of 4820 740 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe 89 PID 740 wrote to memory of 2916 740 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe 90 PID 740 wrote to memory of 2916 740 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe 90 PID 740 wrote to memory of 2916 740 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe 90 PID 740 wrote to memory of 3676 740 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe 92 PID 740 wrote to memory of 3676 740 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe 92 PID 740 wrote to memory of 3676 740 00396e4da96a97766313a548570b5d35_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\00396e4da96a97766313a548570b5d35_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00396e4da96a97766313a548570b5d35_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:2916
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\00396e4da96a97766313a548570b5d35_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies registry class
PID:3676
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2464
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4148,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:81⤵PID:3640
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263B
MD58e0789ff750b413c70a9b109432cf0ba
SHA184c429f3b741a44bced2a137ee62254348e89da6
SHA256f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
SHA51236b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
-
Filesize
1KB
MD5779a07a850ecaa15f9556df0211aa812
SHA171d9bd8ddd02550e263f029291fc735ea867f665
SHA256d49edd4335ae9fbe53d4d8b491b9b9af4f9647df9258b640ce6fa027516bac84
SHA5124e0b47bd5c474cfd32cc0c723b50282fbcba3e1488420d3a2dcdaaa7680d6b2498d04e10767545fa63f9fba8f2711954dffafe52894593b4cb5ca1735f0c773d
-
Filesize
1KB
MD552e99cc30914764f3867bc215a9d13dc
SHA1425f866da470c4f193ba59bf684a7ed935e4e362
SHA25684bd3a74cdd13061a66e9140a0f80e5b025a06d5a9211d713dd46843cba43b7d
SHA512eae15d105533d0aa597417ee8781fb81b33af2ccfd546c1df462a148894ac8efbcbc27e20d427ca94e6193c81bc31fd5ac1b3ac10898e4844c66f3b41c88ab7a
-
Filesize
1KB
MD575887f366667b2254dfd35014d4eb318
SHA103127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA256fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
SHA512953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Filesize11KB
MD54c7125f69cf2046a45daeac49cb0019f
SHA1b4b17fbe1091003ed480f40654f22c89c763f01b
SHA2561102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
SHA512ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
-
Filesize
91KB
MD500396e4da96a97766313a548570b5d35
SHA1a04ca242e2cf71dee431ccd809e943404a5a1e1a
SHA256274788c12871c80676d9f04190bfc3f551952dbe8f32fb7459dff1138fdcecad
SHA51297eec73a60fdbfd5075f615c1a3e22745712a3d1a8394ea0aa774c7525ab2f70a813633f2e5c2976390fd0eb67690655eb66ff6546295fecbbdd2313e9a82a90