e6c0dac1a74211bde74738a6eef490bc67a6f7a40a16df756af4c6ad9d253bcd

Analysis

max time kernel
144s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Size

76KB
MD5

3d2424ece29288234b0527cd7ec2132c
SHA1

8545e96256d743fa170733b5d3438fd48105207b
SHA256

e6c0dac1a74211bde74738a6eef490bc67a6f7a40a16df756af4c6ad9d253bcd
SHA512

6981bb493d6dd9721b42744e127ec45b506ff2853456856e9f7acda39e027dffe0f5a55e430b82259582780cac123956609dc14a116b12f71fd4e6a8de5932c4
SSDEEP

768:EZVy+DZ4mV+RMO2rhgFwuqCbxTGy/BBGg4NKhLU4dhbDW2+Kv00dX0vN0TlT+XyT:eamlu3hbBGy3G8nhMpDG

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nvcw.exe

Executes dropped EXE 1 IoCs

pid	Process
5104	nvcw.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	nvcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	nvcw.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	nvcw.exe
File opened (read-only)	\??\E:	nvcw.exe
File opened (read-only)	\??\G:	nvcw.exe
File opened (read-only)	\??\J:	nvcw.exe
File opened (read-only)	\??\L:	nvcw.exe
File opened (read-only)	\??\N:	nvcw.exe
File opened (read-only)	\??\P:	nvcw.exe
File opened (read-only)	\??\U:	nvcw.exe
File opened (read-only)	\??\X:	nvcw.exe
File opened (read-only)	\??\M:	nvcw.exe
File opened (read-only)	\??\Q:	nvcw.exe
File opened (read-only)	\??\T:	nvcw.exe
File opened (read-only)	\??\W:	nvcw.exe
File opened (read-only)	\??\I:	nvcw.exe
File opened (read-only)	\??\R:	nvcw.exe
File opened (read-only)	\??\H:	nvcw.exe
File opened (read-only)	\??\K:	nvcw.exe
File opened (read-only)	\??\O:	nvcw.exe
File opened (read-only)	\??\S:	nvcw.exe
File opened (read-only)	\??\V:	nvcw.exe
File opened (read-only)	\??\Y:	nvcw.exe
File opened (read-only)	\??\Z:	nvcw.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\Desktop.sysm	nvcw.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	nvcw.exe
File created	\??\c:\windows\SysWOW64\maxtrox.txt	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	nvcw.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	nvcw.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\private_browsing.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\setup_wm.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	nvcw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	nvcw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nvcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	nvcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	nvcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	nvcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	nvcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	nvcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	nvcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	nvcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	nvcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	nvcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	nvcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	nvcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	nvcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	nvcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	nvcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	nvcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	nvcw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2140	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
5104	nvcw.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 5104	2140	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe	84
PID 2140 wrote to memory of 5104	2140	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe	84
PID 2140 wrote to memory of 5104	2140	3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d2424ece29288234b0527cd7ec2132c_JaffaCakes118.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies system executable filetype association
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- \??\c:\Documents and Settings\Admin\Application Data\Microsoft\nvcw.exe
  "c:\Documents and Settings\Admin\Application Data\Microsoft\nvcw.exe" 3d2424ece29288234b0527cd7ec2132c_JaffaCakes118
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\nvcw.exe

Filesize
76KB

MD5
953fe7d877583423c520f2e2564eb293

SHA1
38b4df054b5d55465e260d6412dea3e611679b6b

SHA256
cf8739342ffe2a4290b4526fe9f60b1e0fa02cc4ab3d7c4f4ebe8b47f324fd74

SHA512
f1d251ad572fcb541838cfd3f6796d9fe26675314ef20dfabb0e2bb6dfe9492a85082533c7aa0d00524d3553a9e83fa1115601407c1c41f671019940bfefc492

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr

Filesize
76KB

MD5
4717f429e04cdea1c23721774fbf3193

SHA1
4f5b4e6b0aace4a57f25fd8f940718ce1a4cc27e

SHA256
1449481954e7c9601a3c52445e4c5cc852f2c82b00e9521157154e53330d7afc

SHA512
13acb6dec5703a5d479e0b4ff88b6e8c9b9efcab6a63a8fba628cfbefe2f7e0ab611134f64f42b9b73e67f4dd63434c97dde76b6cd5c21b57059ebab3451347f

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads