df1f78311da3def9946b31ecfad48ede82c1e10e7e910e4e712be440ea1c990e

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Size

1.1MB
MD5

0c3db34d5393b58e1a148b188fa296c0
SHA1

6a6a9939e0850092cbbb3b4e360dd7c09cf20a4a
SHA256

df1f78311da3def9946b31ecfad48ede82c1e10e7e910e4e712be440ea1c990e
SHA512

d07a339e4214a509a6809309e40971bceac0905935b5167fed0dd846a8780d121d3c58dfaf0f1a2b30f7a5f8d45cd0b2943e6d07b11a51380dce13ee0bf5f2e4
SSDEEP

12288:KIZfWaJxlD4HWTnWjmUdn3kS6z2qXBjK54tlTfDCkBR6eeb3MJrs3MJrndUXL:KY+glD42TWjmUd2z2gOSlT1BR60rzrS7

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\DefaultValue = "yes"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_IMG\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "1"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "1"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\CheckedValue = "yes"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\DefaultValue = "yes"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ACTIVEX_REPURPOSEDETECTION	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\CheckedValue = "yes"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "1"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "10"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ACTIVEX_REPURPOSEDETECTION\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "1"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "10"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "1"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "1"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "9000"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "1"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\UncheckedValue = "no"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\UncheckedValue = "no"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "1"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe = "1"	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1612	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
1612	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
1612	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
1612	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
1612	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
1612	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
1612	0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c3db34d5393b58e1a148b188fa296c0_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads