Analysis

  • max time kernel
    122s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2024, 04:28

General

  • Target

    3dcba4c04f9ca42255e8a46e834e8da4_JaffaCakes118.exe

  • Size

    495KB

  • MD5

    3dcba4c04f9ca42255e8a46e834e8da4

  • SHA1

    2d977198f42cca59b34471e8b37598f7b00dc324

  • SHA256

    bfe64e98beb29c2cadd7845a8a86f6831d01e6a63c722673fd3f060bab7c3722

  • SHA512

    5fd707253a28bae9fa216c190095bf50e517cc2dba03206263ca5aa608de5cd29172c0d49571dbb3f0956cbb688d24af635a85b24941e2d1807d053b24fe4c18

  • SSDEEP

    6144:Oe34R2LBu2zh36dqXEVTrnCRZG/t7FTBqTzP7n7O7L6K2Bfo7pN:g2Lbzh36VVTGf0ZTsnz7O7L6ju7pN

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3dcba4c04f9ca42255e8a46e834e8da4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3dcba4c04f9ca42255e8a46e834e8da4_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://pf.phpnuke.org/s/2/2/227542-660172-the-sims.exe?iv=2012101610&t=1728793738
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b320f24223e7c4841dd955fe75f84408

    SHA1

    3dfecdb47e504435743d891f8132639a0c0ddf70

    SHA256

    69919fa33898f6a7861086cdbafd90c4efcd1eab3897f9553146f1f7fde2c67c

    SHA512

    3acb44d5e6fa1ac4459926643d7ded59a396a5acb8b1e672c1924adf1ad48aa22e03a625bcf64a47e1fab148077283480a90e1e6b639748c807f7c074d603a48

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a3e1d478b20ff2bab733edcdd76b464b

    SHA1

    806edfab6280a207460092f6c21658e70ee22c85

    SHA256

    12f28ee87eb63aeb9d1f36d57d780f24cd72b658d46ea307b87d9dbfbf027e72

    SHA512

    9b509e9c52cb35ce2b94cba8b1eda683eba473fd6fb82bb8786b738783b65aa961c67d32afeca5375107f55aa72e2d1b85570c33740b1ecea1b21c47f4085da5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    96fe9f8c6b8d76f7134f2b8a9687d4f2

    SHA1

    7322fc0d8646a88f67ae795cc91dc4c0a948d990

    SHA256

    1a9ea48ac62fd8bf96aa0935d9093b101fc025028e7e840aa00ba4129312ff9c

    SHA512

    2a6b1310917b276d51c7225651d205c3cbfb3270c29c3ba1e312dbbc53f5369bd1cc340f72a8106b2796cff5157cb14ba336bc4c4b09b474246faf20e960a6ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d0cf1bba0e1ce12c995cb9db6cc0e572

    SHA1

    380fb2b040e1431d1da249f47529aca51a187256

    SHA256

    90e640d4602006e9fa2198871d9525130420942268179d3f7bede05ac566a80c

    SHA512

    ba419834fcce3ff98a07879c6ad51999c6658484c9b81b1a4917da44de2c8141e206691e2fda23b94b89020349980ff46a409b5f6e181f6d6bc17154e3b235c7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    475842135f6f6d31deba0e23c97b80aa

    SHA1

    8828a5678bbae8aca37309f74aca175d1265cb21

    SHA256

    f64b691ab5b260c2c2064412c57100c29860c1697f2ea11d506805fb98b428b5

    SHA512

    1c4303cad5d7f2ad4e954eb51a7d94f351b8ebf2311bf3260cabdde9bc90d3a7f39bbb8eb4284d6da0fc0011025432e452a51891bfc770033dcf6a99ecd4dfd7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cfc0beffb42b8485b5c4d854e8ec314b

    SHA1

    9435feee3c097455631db5151953a2e50c9cba86

    SHA256

    c4e0a2c25262bb79989a5ce3c625e2317605bb0592c9ba087a0c17e8a9ee4af6

    SHA512

    2a39b23b83f42a1401294d7be33f530d2b4c921937fe4f05aa63ad3aa59dcea554f9cfcb98d57a5a6faddf4861acb0aefc327016b7c9c58ad1a4605e7e4af2b4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5560bea27c8217918b9f9133ea15ba43

    SHA1

    91f5a472fa1d15a4f224b4ca565c2aa5e7626642

    SHA256

    a83609f7d4904a0259bc092eb04c7614e8a802a9a16e8bcdb0dd9fcc64e6dab1

    SHA512

    d5967b91ff2771442848f1862fa735563c8ee470bf54094730f1972968c49b460827d50b1f8afef717f6f84b6102583adf984191470e58c0703b1a238cff0f93

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c0434374d64e52c1339c7cbbece2d720

    SHA1

    ec0961c6ffd68687e70ce291c90fd6fb5d0c8a0c

    SHA256

    bd2a67e69ecfe7afffe0cba23bcc6f9f0f548422be129110fc80b1d00a6772d1

    SHA512

    25bd9ae43704ca89aa017b7272fbeee66bc29b997a20e52a900b03f2e609525633cc791351c997431e761045bb2883ce9b20b213252474aab807c9538729ed80

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    45ac7fed25b32013bb8d5a9998d37eb1

    SHA1

    cd9435bbfa78be41e302675cbc14cae2e3969fbf

    SHA256

    25737f6c93f8a033289112e9493977dd933d4b37eb25f6a16780f93037144196

    SHA512

    48e62133023105a226fd7945a6a6f5adaa3fa913e2f951465ee7eb565bc177c6c713e6fdb88926db1f3f5498728a7011a498aef03ca132c26ad4ec070584c81c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ee99ff367fab970912d71109d492b5a4

    SHA1

    1bf583bd97971a39a235fa73bfab900ab5a3acaa

    SHA256

    a0ca5c4d535cf57fb8d44ec9097c692b4bf89402486be1594403e0ffd40f62ee

    SHA512

    12a29c4eb35ab1828a86c54ac02002033d3b41642af22af04a2000413d02c3dd8610dda2512d7c8b45a2fd18d2b47c3422569a156bea8f7afbe10c7748e77396

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d6b6285138fe1a97067375b6dd85535c

    SHA1

    43eeac6e3527d1691194095bae12aefb17e31c10

    SHA256

    4e341fc677dc75d321e49798691053e6d36e284c3482259a9b68f7ec1418d2bb

    SHA512

    219139963457616fa3827dfe895b3605966893244390ad9fb7425cbbce45c20dcc3db681ab9bccc24c916ffc97d533c860163ffd6c66f792816e1ac23ece8c80

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    98046dbf72bda97c3b87ada7e6a59fb0

    SHA1

    dc2537baad24edb2b4dc15be5ae3cedae52b1dac

    SHA256

    d34f4e9d911a199404f5ab6e902ff80d3c995e483fda8b43c89ec9fe1d5feb55

    SHA512

    7c864a627170e30db1eff1f3566574e9a025b2520771391666b59313ee6d022850dbb61c22237fce5c2f795ece1d7abe65d0187db50746e4dd4638d8591503ac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b604df262452b4b55483e27d495c05dd

    SHA1

    a80d9ac960b7796386826ce429b2daeead93d9dd

    SHA256

    589d6b86c2ad6d6adfbc0dd7b42df62a7eab923e4a14a66c515976ba37362c77

    SHA512

    eb58d65a47b311875ecaba097b0a5567bf3da1d3fea40757e2e151a67b330acdaf43e1d8b8a21542ea186295195b87ea206004caaa22ba93aa218fc6abcf848f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4d2f2082c70150aea7f90d02c27a0cc4

    SHA1

    623b09310b4b8ae245b1c295321f934e923b7c02

    SHA256

    be0532e96b693284160abc2b91996ee71a78063d39464b7c220b1b61c1d32d21

    SHA512

    40e2a2ceb6a38c7405dcbde9fa877b437bbb8ff891512c97112fb9b808ef0ed0b0f003b619b81eed9d44eac228850f826ab03e5502806484e603b623e3e7f9a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    14f56ec6050dfe79ab290faf468578c7

    SHA1

    9e05dccdf4c5d059b9eb1d0d9ce5f5c7da8ab10f

    SHA256

    3cfa29a9780dd991b2454afb433d288f5c66f347ff6458dddcbf8428818a3631

    SHA512

    e25d5530d0ba3a2a9038c34eae36068e0279dd01f50abfd6d11b0174e0b23f169eed50736e977ffedaad5a720b20285079a461e6577d51cb1106d762e4fe9f38

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    375b987a1cd66282e75c94ef0b17012e

    SHA1

    bc356a42ffb3bb744a1d87d27064d15cd677ccea

    SHA256

    f7d15144350a9c2d527d21a235169d514e84c8f96fe2538543160d4941f82cda

    SHA512

    57ed35cfaea919d566265c9b706a03390f995662a34ba17401a6c800d149f83bc282da7ce00e18b9d91e5e34697805a7df8d0e8c3a31fd27c5cf5cdb831a2378

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    194133c0782d5e351ec7de9d5b6ef160

    SHA1

    ec5454437c6ba4d9e90a17c32a48e2b05065db4c

    SHA256

    f7f4d15446095d730d34cdea0efb95da1fd770577cf88bd3121b3510d909074d

    SHA512

    0324a45318db2cc27813bf376cfa5785f6fc9948ce6d7809de034796039941c699a55ed5f003e215aa27513f17c45b504fe22bb258515c08b0f5cb7fbad868ec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7663b9d73eb35f9157b24268bc0aaebf

    SHA1

    c1344d3331b0e6199481fe113ff1c675ef23fd25

    SHA256

    69c92516d81ec46dac9438af8255ef2588e8b87051857d5e3358c1c98deb29cf

    SHA512

    79fd1ef4e2c6d4d726f7ec7bc736c694194dea4433a4dfc8d26de3b2c8445a55e071a9544c97b3cdf5b091b9fb3dc74652eb8f27a89dd47f116987a2b600d8df

  • C:\Users\Admin\AppData\Local\Temp\CabA64E.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarA6EF.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\nso5977.tmp\ioSpecial.ini

    Filesize

    1008B

    MD5

    a5de990ca0b5620526ab137802bcf835

    SHA1

    ed6628a04da1372a9decd3d71fb7e2af6f68fff9

    SHA256

    6d76ada0dda1fd80e81b0d450ebd17eafb8b34cb980680588f941fd34b00017e

    SHA512

    aa9135c78d484a91f4e73008a403a7ab0442b112134cf3e80c37559ec3cd8c8c7d88eb338161c23dd059721e4059fdf465ce24158ce6617d56c49a8ef9145215

  • C:\Users\Admin\AppData\Local\Temp\nso5977.tmp\show_page_toolbar

    Filesize

    1016B

    MD5

    de86f93cee23f29c4146d0490847826f

    SHA1

    cd01e4525e6b2cb3e6ced0589af4be9c2d0a0826

    SHA256

    b7b742ad61715e695a56cd0d1735d969bc7fc2c68899d823fb3ccc677a966ceb

    SHA512

    3b00c9aa5f3286e963c0ab8e3a827d7382d847ec68313f1a40088d68d0f6eeee61d6a56edc8c45f0a963c80afc9233acaa6fe75123887647ea88ba1aa9222565

  • \Users\Admin\AppData\Local\Temp\nso5977.tmp\BrandingURL.dll

    Filesize

    4KB

    MD5

    71c46b663baa92ad941388d082af97e7

    SHA1

    5a9fcce065366a526d75cc5ded9aade7cadd6421

    SHA256

    bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

    SHA512

    5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

  • \Users\Admin\AppData\Local\Temp\nso5977.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • \Users\Admin\AppData\Local\Temp\nso5977.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    9384f4007c492d4fa040924f31c00166

    SHA1

    aba37faef30d7c445584c688a0b5638f5db31c7b

    SHA256

    60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    SHA512

    68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

  • \Users\Admin\AppData\Local\Temp\nso5977.tmp\NSISdl.dll

    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • \Users\Admin\AppData\Local\Temp\nso5977.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • \Users\Admin\AppData\Local\Temp\nso5977.tmp\UAC.dll

    Filesize

    17KB

    MD5

    09caf01bc8d88eeb733abc161acff659

    SHA1

    b8c2126d641f88628c632dd2259686da3776a6da

    SHA256

    3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478

    SHA512

    ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa

  • \Users\Admin\AppData\Local\Temp\nso5977.tmp\inetc.dll

    Filesize

    20KB

    MD5

    50fdadda3e993688401f6f1108fabdb4

    SHA1

    04a9ae55d0fb726be49809582cea41d75bf22a9a

    SHA256

    6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

    SHA512

    e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8