neshta | f7260b1a600e49566d16d95e98011a1530bda3eecc47cc1c4b37af3403b2e0af

Analysis

max time kernel
149s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Size

960KB
MD5

4bbbf95d1e9e08e941793d09025b64ba
SHA1

f7daf40baa402ac821da552e523b6cf320fbb0a8
SHA256

f7260b1a600e49566d16d95e98011a1530bda3eecc47cc1c4b37af3403b2e0af
SHA512

a7e52d2f0f62ed4626fc1f9c81058d102a61114e7fbacec8d78b41c7b69e8d72f1721a44c66d03659a8c19fc161dc4ba025305a9f97b65c5b0d1a49cf88d90a2
SSDEEP

24576:4wOLewpgW2Ie1HcRAVJlI7P6VBeMMMMMMmrv:4DiwpgQLRAVJcCVAMMMMMMmrv

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4860	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\WinRAR.exe\" \"%1\""	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "????? ZIP - WinRAR"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "????? WinRAR"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\WinRAR.exe,0"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR32	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\WinRAR.exe,0"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3582-490\\WinRAR.exe\" \"%1\""	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4860	4432	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe	84
PID 4432 wrote to memory of 4860	4432	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe	84
PID 4432 wrote to memory of 4860	4432	4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\3582-490\4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

Filesize
2.4MB

MD5
d9e8a1fa55faebd36ed2342fedefbedd

SHA1
c25cc7f0035488de9c5df0121a09b5100e1c28e9

SHA256
bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a

SHA512
134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk

Filesize
1KB

MD5
4aadec301876d8cac9dc67887c3ece48

SHA1
b8da3f1ae2fc71bd08c84b31ddffd933aef87505

SHA256
ca267eb1611e4905221c1006577c0611c6d5dc091c79a0c998016190da535619

SHA512
4c15d0b2a69dd60bd99dc962b023b5f87751078518ea98cffd6f37dff002ce3a2ffc0e6052ea339b314a3b3b51f14fbc992622380ed1efc3afa46821f66fcbe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\4bbbf95d1e9e08e941793d09025b64ba_JaffaCakes118.exe

Filesize
919KB

MD5
399098498d00605a3e0da7227be0de36

SHA1
313cfda91f8b183d6672916014332ec71ece02db

SHA256
b8b5b060505eb58d828f068abd63b525ba61260cc3468d5bbd1f4d37e07e72bf

SHA512
bc10afd1ed231349528678f8c4b59aa4fa47edf94c8ea7bec418fcbe6b89bfa3027a197b82e186e4094d98d6ca538f55a7a46e872809f38dc7d04ef77d5da99f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk

Filesize
1KB

MD5
45fd3b9559cf1fc82446e0bf527bb2f8

SHA1
385b184ac8d4e984111261613c626a0054c5860e

SHA256
93142dc1a219c63c4193fdc7243abec596604b45ecb657c527d803e0771342f0

SHA512
a783a25b3d549eb9aadf90f556485447dd6a22bebf8a0a68049dcd18231614d553129b3e9710d002dc4ad4759b06fbfb8e9ffabb16bb215d026fa7a17f5570ff

Download Submit
memory/4432-98-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4432-102-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4432-107-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4860-113-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-130-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-103-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-99-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-116-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-121-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-127-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-108-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-135-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-140-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-143-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-148-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-153-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/4860-156-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads