7bbd34eb73b58d44754daae36c48bbed5a7989a4614534b115a7aabee401d496

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
Size

414KB
MD5

2f0aa5696b037053f6fe22f05e8b91c9
SHA1

74beae5c09c73f9841fe0348d94fd3332f0ca960
SHA256

7bbd34eb73b58d44754daae36c48bbed5a7989a4614534b115a7aabee401d496
SHA512

ca867d5441fb2ce83fd801d4696ed68d01d174ed9de54cab696a4943d22a8df12f7eb7c0c72086394434411de48b1688933c9931d55bbcf8fb967dbd0bc5fd82
SSDEEP

6144:m/GzBKRBM7s3mRr+ol8B55sc+IDpKo/AAODMQ7Mp4ZlJAKEI/q5Dj83WImW:LbwWRS5sc+ID9NODMQ7XJAK4gWImW

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ANS2000.INI	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
File opened for modification	C:\Windows\system.ini	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
File opened for modification	C:\Windows\win.ini	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
File created	C:\Windows\a3kebook.ini	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
File opened for modification	C:\Windows\akebook.ini	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
File created	C:\Windows\akebook.ini	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2380	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
2380	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
2380	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
2380	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e\83408-040712-212552-78.a2k\index.html

Filesize
7KB

MD5
2ee048556fb668c451a8829a2a403ce1

SHA1
4bdc2821c3f710904cfb0a335f487d5fda0a235b

SHA256
90e1845a76d13e7fa45ace2fef4ef2c51ca28ba11df283615503633727bb6cb7

SHA512
dc6a5224f4074198ca5be29af63ea0dcdf10b7277efffbdcb60c54ceb3e55e8952811780677d4e91b9b0cbe06aa22aa167202b1fc2cf15123f50f03f07b59b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\e\83408-040712-212552-78.a2k\style.css

Filesize
2KB

MD5
d07c418be56a76cab52160596f51c5e9

SHA1
1845b428e288e833d406fd24c4e9be44ed130e00

SHA256
8863ecc303c7419247687e767a071f5cfc2ac4223f5c5fa2be344ec2a329ac01

SHA512
3a6ec4c079faf467ffe992ab64e60abe062f76c4ba797df16e760dc1d604fbe4cbd4f2e8b8096c9e439bce81ff1c5c9dcef3ef4fbafcefe22cbac8d5ceddcd8a

Download Submit
C:\Windows\system.ini

Filesize
276B

MD5
480675babc578f3b15ff89c997b02709

SHA1
4fe8b9bacef2c8e015102975939b6ac194370f8e

SHA256
76811f59ecc3a79f9cabfa49ce54960edd91ca81be0ee6314be2f2a8dc6e7f4c

SHA512
759b455e28076b35f711d89a832f949e4ad3a48c6d4b5bfa97f879b6e2052a43ec2018aaaafba4c189da20352a3d2ff04d6df76e2a4f1c1e6cf9184157d52dfd

Download Submit
C:\Windows\win.ini

Filesize
569B

MD5
790d7bb6b337bf3da4e00cc3244a6eda

SHA1
ee896639dff285d0ed12cddcce8e9339d7c1fa97

SHA256
4ba433c3659847901b7283894928a9e50e4a9e999cc6446a63af204a304104db

SHA512
6e73ed895495f00a1b0345e3c81be3f9e5b8f68ead6bb02b893615e036a139ec9060daecb00f1eccf38d08abc042a4975d0906d81e492f609f764b4e1fab0634

Download Submit