Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01-10-2024 16:56
Static task
static1
Behavioral task
behavioral1
Sample
069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe
-
Size
480KB
-
MD5
069e9132a4323ae91d1174e70423d90b
-
SHA1
a80e6d06edb3e4d766dddc72b51606173b801743
-
SHA256
dbabe6c474e02ad3778f66620312beb82d786f3097d0388e888cefda2280ab1c
-
SHA512
992561f47073a0bc9d15ea424c90ddce1913f7e87840981bf385c5ffcdc28196e2dc513ca87ff38e35e7d4533e1f0b132b4fe5abe98baba2de7e650ca66fd147
-
SSDEEP
12288:AteULVUBvCkfmvz756FGtkeSUknzp7tRuvftbObI:KeYVUV5a75G0OtXggbI
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 3060 069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe 3060 069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe 3060 069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main 069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3060 069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe 3060 069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\069e9132a4323ae91d1174e70423d90b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5cad20144ce29f20fecd6c21c5c61dead
SHA16bbaeb0aae32a3828cb77f8bfd3fb493803f3626
SHA256e68cb263198cf8cf93e5a60be4ff091606be78b0963aca0e519732187ea93e80
SHA51235e0f7c8cb13693d7e3a221f186bd72613544dc75e5355550bd0e7ed7054831258c5a487d20b412ce646313d24b3436baf10597baa8a359a319dbeee26580ad5
-
Filesize
55KB
MD5bb381e2d19d8eace86b34d20759491a5
SHA13dc9f7c2642efff4482e68c9d9df874bf98f5bcb
SHA256c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899
SHA512abb2ad8b111271a82a04362940a7ab9930883ecb33497a1c53edcdc49f0634af5bf5b1bc7095bd18db26d212b059aece4577f85040b5f49c4982b468fe973c12
-
Filesize
1KB
MD5f1cf73e00c240e9a4283201291d45a07
SHA1918c49cb6f1de521d91967b2508f19db1f38fea2
SHA25681bce5ff1003c9d5a688102d5d4c603841ed61c32628823dc48d560ec0d42cd2
SHA5122242892434a638a9344c87453c3d2a66a880278dcf66f1516f240131dca767248baf663ffc9365acad26550e5b20a742d8115d5976de3a094d0229d60844788f
-
Filesize
446B
MD5157d5a5389521369e8d42bf50dd9e4e5
SHA132f0877615d73dd0f952dbaf1425e2e61e8082aa
SHA2565688c7509f409b9f06d40f247000833f8318e4d20dbb6a2dff7fdb74df220bed
SHA51275a583cfa7bd4fb4eaa73b3e189a5dba4116479c5ac5c6be8db95bb656b3951013493ada964d8abf4d5140732ae3e0e1e09e9f48622d445460532ec8eef06f1b
-
Filesize
1KB
MD50d0e0532f51af856688ad83abb889fde
SHA1a1949b703816fa1bc60cf9c395d6dbb0f6f5c61c
SHA256a358150647aaf4413fd2738c8ebcc0579b0bd4ccca8ba02738a4332a430f8ec8
SHA51229322e2446ae5a37a34f113be5924121ce7d8fcfc617818f59c407fe7da01153845a947464345d6b86463b18c75d0adae1cc7dd5f17cf2d29584ef9539d8e0df
-
Filesize
946B
MD5354dce57695e99df9e6faba76346496f
SHA1ca364e2daa4a80cfed7412b0f0374f1f82fa7146
SHA256bb39b6b14ae7f032922366943b342f58be120242020b1fa4dbb3310e39928823
SHA5128f34ae59e5502c70659e358d03709cfdfd01ec2128110932910e8de16888857896e86707c279b3f67edb54059a08ab6ce05b742342e825e2894580ae4a4639ee
-
Filesize
6KB
MD5682fea27f4c335defc18be6fb24d5748
SHA1d4a1743d63508d18af4be59232f3d266228648fb
SHA256928571317e90c4d6680931dffaaae85f382069be2bc72b875810ceb1f7c2744f
SHA512ef70ad8c291fe10c8b1d0dc060fc50b4593cf6fabc03a751aa62d5f4e375b1c80184337816a8e50430964960fc56324259f8833707320c7b757e388ecbd28341
-
Filesize
17KB
MD5aa91818150cfadb667ae6f914d43dca0
SHA14411bd0038ccd464ed7597f0540cfe04867b9042
SHA2562aa71646493cf47b38be0920488159b154eaf19193dc4a6ecfa0a6509196c7c5
SHA512dd1310dc52bb6cc4977341dc34fb6a273e1349602a5fb3037e0b0d087b8f0d2d7a04e2db32e2708379758266c31422d27b5a35f5ba068cd7dbdd211b07893ecd
-
Filesize
164KB
MD5ea4317c168bd32ee3e8c2901b16063d9
SHA167848e43cbb25baf066334ca807034e2a80c6c8f
SHA25611bd15b3aa026ca505f798fd05348fa877b5d7e93fd7e51b676f5af78d09bf05
SHA5128d218457144e4eb10da92fd7167a25c4292e51be49a271805e9a206e86c21e5fb877a2adec7ebaa170a6e677c10c52a6f4fd807f47bdff17f99f7dc531017aa8
-
Filesize
243B
MD5c74cc101f96818463168d4c98437507e
SHA1394129eeed767b675d5db8b588857916571f2169
SHA2563600f0a96ddc4c3f2515e5bda69eed1e6b6ca643c28cbc15dee3b96ea10ac1fc
SHA512a12fb7b28a1b8cd9ada2e5a27952f0887e4996d5b10d6cd977a646d9348eea03dc67fb83d00f219f2c256de5c7e2de1e7029d106b363a6299cc558bf73e462ec
-
Filesize
1009KB
MD59f33f5afe6693f5ef2bab1ff9b68ca52
SHA101b12b2c2b389d2337548b6d41a11be4516d8039
SHA2567da9d3591d9b319484e4f651a1218fcfce6254315c2dab77519c11279ba25ced
SHA512221256a8048a442322e2da961add20e46ff669cab29274e41824d00638a2ca3ce0b29a3987856db891862983e5cf8d417d113fe7653ae62ba47d77f3bb716cad