7bbd34eb73b58d44754daae36c48bbed5a7989a4614534b115a7aabee401d496

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
Size

414KB
MD5

2f0aa5696b037053f6fe22f05e8b91c9
SHA1

74beae5c09c73f9841fe0348d94fd3332f0ca960
SHA256

7bbd34eb73b58d44754daae36c48bbed5a7989a4614534b115a7aabee401d496
SHA512

ca867d5441fb2ce83fd801d4696ed68d01d174ed9de54cab696a4943d22a8df12f7eb7c0c72086394434411de48b1688933c9931d55bbcf8fb967dbd0bc5fd82
SSDEEP

6144:m/GzBKRBM7s3mRr+ol8B55sc+IDpKo/AAODMQ7Mp4ZlJAKEI/q5Dj83WImW:LbwWRS5sc+ID9NODMQ7XJAK4gWImW

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ANS2000.INI	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
File opened for modification	C:\Windows\system.ini	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
File opened for modification	C:\Windows\win.ini	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
File created	C:\Windows\a3kebook.ini	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
File opened for modification	C:\Windows\akebook.ini	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
File created	C:\Windows\akebook.ini	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\IESettingSync	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5116	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
5116	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
5116	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
5116	2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f0aa5696b037053f6fe22f05e8b91c9_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e\83408-040712-212552-78.a2k\index.html

Filesize
7KB

MD5
2ee048556fb668c451a8829a2a403ce1

SHA1
4bdc2821c3f710904cfb0a335f487d5fda0a235b

SHA256
90e1845a76d13e7fa45ace2fef4ef2c51ca28ba11df283615503633727bb6cb7

SHA512
dc6a5224f4074198ca5be29af63ea0dcdf10b7277efffbdcb60c54ceb3e55e8952811780677d4e91b9b0cbe06aa22aa167202b1fc2cf15123f50f03f07b59b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\e\83408-040712-212552-78.a2k\style.css

Filesize
2KB

MD5
d07c418be56a76cab52160596f51c5e9

SHA1
1845b428e288e833d406fd24c4e9be44ed130e00

SHA256
8863ecc303c7419247687e767a071f5cfc2ac4223f5c5fa2be344ec2a329ac01

SHA512
3a6ec4c079faf467ffe992ab64e60abe062f76c4ba797df16e760dc1d604fbe4cbd4f2e8b8096c9e439bce81ff1c5c9dcef3ef4fbafcefe22cbac8d5ceddcd8a

Download Submit
C:\Windows\system.ini

Filesize
277B

MD5
1a1da8c7e8f316846e2ed3b82501e1f8

SHA1
ada338e3ec081effd25d6782e9aa5a6c372814ba

SHA256
b3e550ba06e40b8dc95ebad56075c32f7ec317288148496dbe23241a0d8212ed

SHA512
deb0c01a387c497b17b8db2db418789a07221517c76934f3140c23de1682a126caa9e06daa32f506170ca5a0d6606171a439a29a5ac9a134f4b39c44558ca5ed

Download Submit
C:\Windows\win.ini

Filesize
183B

MD5
cb1895edd0fb614c585d77ddec28ea61

SHA1
4fb5482a8707a966fd287a55d7ed0806656b9e39

SHA256
f65800a6fb81b90b75885d812b9e3622caefa5d4558ebc245907961c7de82107

SHA512
1b44d39d548c92d1e68d5e3fbb9605a34107fb7f31cc94fa2f820448a1bb708bb7ba4b998c022738f44170e55fafe19466523fead91bc2d73cf61a6e9c4398e5

Download Submit