Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 06:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe
-
Size
44KB
-
MD5
04c559f7bd472d0d6c1499de08aee856
-
SHA1
6ac4d99ea621b8ca638925d552433affa77bcf37
-
SHA256
343749024ded690aeb76730a6f5b7ba0ca0293efbb14d0946dd524eed07c48a0
-
SHA512
b7f472b45b00cc96738b49695266a009b5a642a14b511dc58ccd351d59e64964e4a4acb969b296dfc08c0a72bd1b1957ab4efb603d12f8072e8f6ef96abe7775
-
SSDEEP
768:+BEmXOidc1Br4P52Tcto0xKnf7ycMxd4vIiwQiytUDfFLVvkG4zI+GEGd:+elBr4P52oNKfIx+BwzL/vr40hd
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1}\TypeLib 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\ = "prj1128A.CVSVirus1128A" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\TypeLib 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}\2a.0\ = "prj1128A" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\ = "_CHXSoft" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\TypeLib\Version = "2a.0" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA} 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\TypeLib 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\VERSION\ = "42.0" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\TypeLib\ = "{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\Programmable 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}\2a.0\0 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1}\TypeLib\Version = "2a.0" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\LocalServer32 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prj1128A.CVSVirus1128A\Clsid\ = "{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\TypeLib 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\Implemented Categories 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\VERSION\ = "42.0" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\LocalServer32 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1}\TypeLib\ = "{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\ProgID\ = "prj1128A.CHXSoft" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\Implemented Categories 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1}\ProxyStubClsid32 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1}\TypeLib\ = "{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1}\ProxyStubClsid 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\prj1128A.CVSVirus1128A\Clsid 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\TypeLib 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prj1128A.CHXSoft\ = "prj1128A.CHXSoft" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\ProxyStubClsid32 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1}\ = "_CVSVirus1128A" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\TypeLib\ = "{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\VERSION 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\ = "CHXSoft" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA} 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1} 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\VERSION 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prj1128A.CHXSoft\Clsid\ = "{7BA3377C-B524-4259-84A3-A7A08E12A630}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\ProgID 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\Programmable 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630} 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\prj1128A.CHXSoft\Clsid 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1} 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A8ED97C-EBD2-404A-BC02-43E5CCF2F4C1}\ProgID\ = "prj1128A.CVSVirus1128A" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\ProxyStubClsid 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}\2a.0\FLAGS 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}\2a.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}\2a.0\HELPDIR 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}\2a.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1} 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6} 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}\2a.0 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\ProgID 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA3377C-B524-4259-84A3-A7A08E12A630}\TypeLib\ = "{A6190367-BCBF-4EF1-BAF6-09C1D536E4E6}" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\ = "_CHXSoft" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0335608B-F7B1-4347-9DFC-B19EF6AA47DA}\ProxyStubClsid32 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04508E44-22E9-47B8-9304-0FC4732D9FE1}\TypeLib\Version = "2a.0" 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4520 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe 4520 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe 4520 04c559f7bd472d0d6c1499de08aee856_JaffaCakes118.exe