Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 05:58
Static task
static1
Behavioral task
behavioral1
Sample
38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe
-
Size
52KB
-
MD5
38b9717405dfa21c94a01e84cadfe75c
-
SHA1
ae0544603e4fd3c882ffb31b5bea2ca782c11909
-
SHA256
9be726dbe62857a8cb1481f147e8861e4c02e9064e146d1c3c75b200a32c3f17
-
SHA512
9dc4a2b0089cfe28a7f4e1970b2588f976c83ed2a13c5deb1d46f94506058007e01fe559365267424c6ad3d82675dcf3701fd7cc3325cea5b374adde46bb659f
-
SSDEEP
384:7i1XeX9SyjgpWA5Or9IhBKT0CF0YrNlqR2NYm1dyyAv13JsvHOeskCWHy/:eXYB0UcOrYKTLbDDQRJSH3skCq
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA88}\Shell\Internot Explorer\Command 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA89}\Shell\°Ù¶È\Command 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA91}\ShellFolder 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA94}\ShellFolder 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA91}\ShellFolder\Attributes = 00000000 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA93} 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA93}\ShellFolder 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA94}\ShellFolder\Attributes = 00000000 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA88}\Shell\Internot Explorer 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA88}\ShellFolder 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA89}\Shell\°Ù¶È\Command\ = "\"C:\\Program Files (x86)\\\\Internet Explorer\\iexplore.exe\" http://g.freeshipin.info:1188/baidu/index.html" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA88}\Shell 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA88}\Shell\Internot Explorer\Command\ = "\"C:\\Program Files (x86)\\\\Internet Explorer\\iexplore.exe\" " 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA90} 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA92}\Shell\׬ǮÏîÄ¿\Command\ = "\"C:\\Program Files (x86)\\\\Internet Explorer\\iexplore.exe\" http://facai.jiankangmm.com/" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA92}\ShellFolder\Attributes = 00000000 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA94}\ = "½¡¿µmmÍø" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA94}\Shell\½¡¿µmmÍø 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA89} 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA91}\DefaultIcon\ = "C:\\Program Files (x86)\\\\Icons\\ÌÔ±¦.ico" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA92}\DefaultIcon 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA93}\ = "ÓÎÏ·" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA93}\ShellFolder\Attributes = 00000000 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA89}\ = "°Ù¶È" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA89}\Shell\°Ù¶È 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA89}\ShellFolder\Attributes = 00000000 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA92}\DefaultIcon\ = "C:\\Program Files (x86)\\\\Icons\\׬ǮÏîÄ¿.ico" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA89}\ShellFolder 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA91} 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA91}\Shell 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA93}\DefaultIcon 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA93}\Shell\ÓÎÏ·\Command\ = "\"C:\\Program Files (x86)\\\\Internet Explorer\\iexplore.exe\" http://g.freeshipin.info:1188/game/index.html" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA94}\DefaultIcon 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA88}\DefaultIcon 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA88}\DefaultIcon\ = "C:\\Program Files (x86)\\\\Icons\\IE.ico" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA88} 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA92}\ = "׬ǮÏîÄ¿" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA92}\ShellFolder 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA94} 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA93}\Shell\ÓÎÏ·\Command 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA93}\Shell\ÓÎÏ· 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA94}\Shell 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA94}\Shell\½¡¿µmmÍø\Command 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA89}\Shell 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA90}\DefaultIcon\ = "C:\\Program Files (x86)\\\\Icons\\Google.ico" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA90}\ShellFolder 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA91}\ = "ÌÔ±¦" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA88}\ShellFolder\Attributes = 00000000 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA90}\DefaultIcon 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA90}\Shell 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA91}\Shell\ÌÔ±¦\Command\ = "\"C:\\Program Files (x86)\\\\Internet Explorer\\iexplore.exe\" http://g.freeshipin.info:1188/taobao/index.html" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA89}\DefaultIcon\ = "C:\\Program Files (x86)\\\\Icons\\°Ù¶È.ico" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA93}\DefaultIcon\ = "C:\\Program Files (x86)\\\\Icons\\ÓÎÏ·.ico" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA94}\DefaultIcon\ = "C:\\Program Files (x86)\\\\Icons\\½¡¿µ.ico" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA94}\Shell\½¡¿µmmÍø\Command\ = "\"C:\\Program Files (x86)\\\\Internet Explorer\\iexplore.exe\" http://g.freeshipin.info:1188/jiankang/" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA92}\Shell\׬ǮÏîÄ¿ 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA90}\Shell\Google 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA91}\DefaultIcon 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA91}\Shell\ÌÔ±¦ 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA90}\Shell\Google\Command\ = "\"C:\\Program Files (x86)\\\\Internet Explorer\\iexplore.exe\" http://g.freeshipin.info:1188/google/index.html" 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA93}\Shell 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3C1BC70-1607-43BD-A055-ACB4BF8DBA90}\ShellFolder\Attributes = 00000000 38b9717405dfa21c94a01e84cadfe75c_JaffaCakes118.exe