de2f58693abe61afbfbb0c05b16b5d1ff5ba8d016dd0ea673b029d40a678467c

Analysis

max time kernel
122s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe
Size

141KB
MD5

53451800e58982fb6bb0678b564f6f3b
SHA1

43a5bce04c094458b2e4f7a2ad6f575b6b7aa373
SHA256

de2f58693abe61afbfbb0c05b16b5d1ff5ba8d016dd0ea673b029d40a678467c
SHA512

b09bef532b7d1ff7ffa5d065eb3b4a3b7432caa86dfa01f220a52f319b7a6ecf17955874ef1e70e789217f98f194e514f647c8487cb0e4c2fb404723c3db6423
SSDEEP

3072:aCFsr3T7w5e55dK+CAQtXicmWURn/UMcOnqW8COipSbn2:aCY/w5e0xlzmWG/UMosIbn

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe"	53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000fc614a5f3349e69e1d3307faa20feff4fd12a015b2f7eee864354ab429cbbb30000000000e8000000002000020000000e1a2a0ea51dd8e605c3ef173b77e1c949c10f311ac2e42e96c99fe9a110a319120000000ccf4b7dc5ed93d91467681fb9f3ec6386bbde07295799f5e34738be7f97d687140000000c12551f6a81738ecdb0ec6c189fd412a4a240a466b585a0497972672ef0463aa1e6a55e1d1cfca2bee1b95d961cf62967305d3acc2f293797dba94d30ded8ae6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ad5f11c920db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AEF91F1-8CBC-11EF-BE2D-CA3CF52169FD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000e9f906eefc57f574ea4b336fb4d23788ae4782ec5d979951145e863b650a278e000000000e800000000200002000000069079c1dffe45450c22252990512ff7e72e999a23f54c85056e281faa49a3dea900000003dfe83cea3aa9f36df08a2f2f361b9fcee29bd72efdd9ed1afe11cce04eaecf69f82c34d009092701e1f2a6eb157cf2d96fda92a81c3868e6a1572cae65626971409fd6371eac3401b973360c2371d2bb5eddb71a0a35f246ec6cf1be08263fc1fe7864b01145a8c2bc69bbd5f6aef34bff45b46c437a7a3ad63cc93945a5c2f52c451b8f0a6b5e43791231b982cdc27400000006371c6ccfd238100814c4662b520322d81dec67519e713812d9e4ee553afca894bba54f5e04dc78ea24a09f28f434e5af4057cec8e63a306d7148631eccdbc84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Download	53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001"	53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435354426"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
844	53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe
2992	iexplore.exe
2992	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2992	844	53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe	30
PID 844 wrote to memory of 2992	844	53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe	30
PID 844 wrote to memory of 2992	844	53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe	30
PID 844 wrote to memory of 2992	844	53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe	30
PID 2992 wrote to memory of 2628	2992	iexplore.exe	31
PID 2992 wrote to memory of 2628	2992	iexplore.exe	31
PID 2992 wrote to memory of 2628	2992	iexplore.exe	31
PID 2992 wrote to memory of 2628	2992	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\53451800e58982fb6bb0678b564f6f3b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/watch?v=vsd3g0h_vs0
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e98be1018d47d11313c9fd4482ac0eb6

SHA1
00f3a7b3c29c6c0c1796d1dac4861aa3bbd79ee5

SHA256
f7eef738e0ab353c02f3a44da70e0c4a6ced75b552da4ea16b13eeb6047eae6f

SHA512
29aac8a156d8d9364fe44672764c1c01d4c3d99b12a14866cc13de421ec7ccbc029e4df2bb92126b4f069de0b04014b6534bd2e6c72600a2fcbf754226be1af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b394c2d2af6b8d384037bcb741e40efa

SHA1
1e0f79f6617b567064b70153430625a604edadcc

SHA256
7f7d29c09b4b3c23c091eeea8ebe6e4153ea8528c807553eb36fa599fa10dc35

SHA512
2f5e3a4968195f49296d8066e5f6d085feb7907f25261bd7099f240432ddf3b925212dbd60359647987b713fef856163b19bf7533ce0c7e4855dc3cb13b4cfae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcfc4d4c406bcc8e2ebdc7c5c35938bf

SHA1
387c98434c65204c59989db2a7e33d4e183f214e

SHA256
f3cad70159e20e7dd34e08d0fcde323767669b04707371b2937bf99ad6c8af2b

SHA512
aeec6b62f03b0d6a2e58853feb4c3d4f335f8e544e74cede79ae696b7b367f4372861247d724442fe52c6a331f53c1bf64f7aad5781ba3c770878ddadeb8585f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba70f0a740378b00dbe7e18f986b6004

SHA1
4e78f3b05b45a69bd084e9884b0da3618cc52e3f

SHA256
0d390a35399ec25aeb90cfd71e1de034447d784a491c8a5eb08b52c35379c22f

SHA512
126def3ce7e2653e85512739bf8c7841fb3e0cc49bcf3edecfea40b2436088bdc089d210118f9a4b20e96c455c850f11cf01d1cc31ae310a81c672eaa27de333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6408bebe50e561fce4d254c674711a3

SHA1
ff2a81cfb1c97943bbe432a6c1684f3e4217904a

SHA256
6dafeb996904e3e94b637953f5273895412405485b41ae19b8529ca9907578f7

SHA512
60aec04a3302a3978c8c46db2e16679ee0b7ca582205f5659f6d49c4b6923837c1b32db54b881eda15686019bbf8e180870152558be6c97c18ea7fd68e10fb7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
201f5f34f6c581e9eb9beda4acd1bfb1

SHA1
611d4106a8fa4506149da036155e2af8a15985e2

SHA256
b3aa1d21dde418e46bdb56a956a0d790af6bd61601dcc2e02249a9d726a5093d

SHA512
72bdcb09c40c27c737977ee2a173b87a8601a22bfcba11e9d182d58232684f011ab05b4a1cdab040cccb3a38b9dc3fc3ee5c1bf033a3c7b36693648cd4377b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc39204af1e2307213efc6d48c68f029

SHA1
8ebcea6eaa73ab054677b408ed1dbf5f96604204

SHA256
1396c8792af2bf8038c055210214d8562dc2b6bc0766a8dee64136f0be101961

SHA512
94bfe885c81d0e14659761e6d8b5f5373e8ff9f82cd209797e153dbf825fa74e08ae7766d1ff2f427b0c18af59881675a50f9b56adceda3ae247a0534f752049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87079a699e6ec11be7fbe4bf0083ea7a

SHA1
81281a31064299a6fd1eec078b81b4104b6c1e72

SHA256
737b41e0cbff9c980eedf045c69ae401373a93fcc7292c187c68b49292c398e1

SHA512
8e53ba989b387f9da8567b0561c1b31c19d274cea89841444e2526f7f7465c60402ad2084d4bba18fde4ef9369c30940c88e662b95aa22fe108b6163992b09e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\melo7gx\imagestore.dat

Filesize
1KB

MD5
714f020783cc968eb3118f52463b6346

SHA1
e30b0251fcbc8ace36f2490904c60286775589ea

SHA256
82ae4382e99c98798d05d8d9a2e102cf9c599746be1f49e38d5dcbe5edb5cc75

SHA512
d2887e1b6438a41b73eff77b55d60fad6ed6f9d7e0fd787aec4eaec2cc98024fd998c541cfdab5fbe9c02881b62a000545cce0cccfe6d9fb59eb4f03acf54f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\favicon[1].ico

Filesize
1KB

MD5
f2a495d85735b9a0ac65deb19c129985

SHA1
f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

SHA256
8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

SHA512
6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9475.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9477.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/844-0-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/844-9-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/844-7-0x0000000000280000-0x00000000002C6000-memory.dmp

Filesize
280KB

Download
memory/844-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/844-3-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/844-2-0x0000000000280000-0x00000000002C6000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads