f2f93ba597e572c9fabbd3446f27ade3c20cec946e557a2147b82d6773d0d107

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Size

100KB
MD5

54b02e9b6fff8c5cb88d5ecf82cb849e
SHA1

0167a067c6adce5aa418fca9744981e5ebc9bc58
SHA256

f2f93ba597e572c9fabbd3446f27ade3c20cec946e557a2147b82d6773d0d107
SHA512

73b9fcb3d73456356a892c7f9d96204646245eb5ec9c1dc7f70bbc4bbec0558ab45b15968d12c14885d251c41d93ba79683e729ed0e6db4c34b601414a61fc2c
SSDEEP

1536:9EHVwQWrI0Sc6YDXTwKtmwuVjnw2ynkgqPwn5zDZT125DmQ8:m2hsXZYHwRBVUmgqPwnbEDmQ8

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1684	WScript.Exe

Executes dropped EXE 1 IoCs

pid	Process
4448	Program FilesN57B5S.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\t.ico	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\d.ico	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.Exe

Modifies registry class 60 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command\ = "IEXPLORE.EXE http://www.henbucuo.com/?1121"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hpf\ = "hpf"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.h35\ = "h35"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hli	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hli	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,130"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command\ = "IEXPLORE.EXE http://www.d91d.com/?1121"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hyx	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hyx\ = "hyx"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htb	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command\ = "IEXPLORE.EXE http://taobao.loliso.com/?1121"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htb\ = "htb"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command\ = "IEXPLORE.EXE http://www.35yes.com/?1121"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hli\ = "hli"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,139"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon\ = "c:\\Program Files\\Common Files\\t.ico"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command\ = "IEXPLORE.EXE http://www.loliso.com/?1121"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hpf	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\h35	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon\ = "c:\\Program Files\\Common Files\\d.ico"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hdh\ = "hdh"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htb	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hdh	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,41"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command\ = "IEXPLORE.EXE http://www.piaofang.net/?1121"	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\hyx\	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.h35	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2672	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 4448	2672	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe	87
PID 2672 wrote to memory of 4448	2672	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe	87
PID 2672 wrote to memory of 4448	2672	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe	87
PID 2672 wrote to memory of 1684	2672	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe	93
PID 2672 wrote to memory of 1684	2672	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe	93
PID 2672 wrote to memory of 1684	2672	54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\54b02e9b6fff8c5cb88d5ecf82cb849e_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- \??\c:\Program FilesN57B5S.exe
  "c:\Program FilesN57B5S.exe"
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\SysWOW64\WScript.Exe
  WScript.Exe jies.bak.vbs
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program FilesN57B5S.exe

Filesize
9KB

MD5
c2b8e681451e119d42a1b86a20b017b4

SHA1
77be49beb571478eef53ceb2d4e83f768d82ecd7

SHA256
a50e8ec558aabf6297af1772b091bfd7391e3761a2e21940f660ac459ff9e689

SHA512
ad5899b3e3f8619cca2eec7b1751947fe05a2b31aca7264fd5a057b52de7651cf9107e34dce2a47d88326377b20168c073722231641273a01ca1cc1834c85194

Download Submit
C:\Users\Admin\AppData\Local\Temp\jies.bak.vbs

Filesize
450B

MD5
b63728926f5d873063ea09689ab33112

SHA1
f0a75cbd4f7b3a3aa595298d5849400f982f4706

SHA256
002429918aadf06c933b79c63f97d46903305f873333707cef2341d8d3630200

SHA512
72dd359d663ee00811c05d5b892a40f84ccc4fabb4a011cfa9b511f15d94cb00d48e1bb7035bf673a81c01cccf6419d530a7035a31f4fee7224f070301d548e1

Download Submit