ce94aa16e5dfa06c20877552bca12a859a6bd367eb422f72c2f6ae0372c89ef7

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Size

1.2MB
MD5

12cd1d7b3d3670f4314986a76b7ae2d2
SHA1

a6dc0042199c34fb3f194dd9475ec63cd1a27ec6
SHA256

ce94aa16e5dfa06c20877552bca12a859a6bd367eb422f72c2f6ae0372c89ef7
SHA512

de396c378feaf224b1fb37f0474389092c201811a6b1d40ea46fc82507df3d8ccde7083650fc658c5cc7aa6eec0afe8fea6e1fc42859a3456f772cd37cad1b49
SSDEEP

24576:4y/4UiZTW//ao6BRm4hLKmVVTQBKo/KSg+yJJod3reFA6ymcXqNps:4y/a1BRm4dKwVTQnsbod3apymcXms

Score

7^/10

aspackv2 discovery

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000700000001211a-2.dat	aspack_v212_v242
behavioral1/files/0x00080000000161f6-5.dat	aspack_v212_v242

Loads dropped DLL 2 IoCs

pid	Process
3068	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
3068	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ProgID\ = "NBRun.BrowserToDelphi"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\Clsid	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\Clsid\ = "{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\ProgID	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ = "BrowserToDelphi Object"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\Version\ = "1.0"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\FLAGS	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\FLAGS\ = "0"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\Version = "1.0"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ = "IBrowserToDelphiEvents"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\Clsid	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\Version = "1.0"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\LocalServer32	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ = "IBrowserToDelphi"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\Version = "1.0"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\Version	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\TypeLib	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ = "IBrowserToDelphi"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ = "IBrowserToDelphiEvents"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\Clsid\ = "{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ProgID	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\ = "NBRun Library"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\HELPDIR	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\Version = "1.0"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0\win32	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\LocalServer32	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\ = "BrowserToDelphi Object"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\ProgID\ = "NBRun.NeoBookIEProtocol"	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}	12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\12cd1d7b3d3670f4314986a76b7ae2d2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\94DF97B7.nbp

Filesize
294KB

MD5
e5575e8d61ca62bdb7491b88df590ce3

SHA1
c0580f4d63298f508cc7a9b14d0e7477f5a4c27b

SHA256
df135026069742aba1b255b9bde400749359e1a821aee3799daf15e5c58872e5

SHA512
c423404cae5d90e5fe8d98cdf55a92bd815940128b9a7c8e647a36db02623f621fe7422bbe2e75009f33bf3b6229d1947c70776b042195cf747b5d14460a4a0c

Download Submit
\Users\Admin\AppData\Local\Temp\94DF97B8.nbp

Filesize
422KB

MD5
2fd0836d049bdffdc11d76b36732f3fb

SHA1
e751066f381525a4e2b892450fc00d90c60bb271

SHA256
26977cf094ec15191beef7268a41281a1fa0f22221c485ea8ccad9f7142d4445

SHA512
802b1cb9d2a129fa36968dde62539d76a265470e8a1db68d08877e83ba5c1101a7d24ec09198316cd15c37d1e54452fa643fcb4689a37c1b1183940ab642a46b

Download Submit
memory/3068-15-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-9-0x00000000039C0000-0x0000000003A57000-memory.dmp

Filesize
604KB

Download
memory/3068-10-0x0000000003CB0000-0x0000000003D9E000-memory.dmp

Filesize
952KB

Download
memory/3068-11-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/3068-8-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-12-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-16-0x00000000039C0000-0x0000000003A57000-memory.dmp

Filesize
604KB

Download
memory/3068-17-0x0000000003CB0000-0x0000000003D9E000-memory.dmp

Filesize
952KB

Download
memory/3068-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/3068-18-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-21-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-24-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-27-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-30-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-33-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-36-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-39-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-42-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-45-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3068-48-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download