d9b393cc9a9e8f84e9df308b9e931f4b25bdd34c6ea8db07b4df3f246bd5d2f8

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Size

1021KB
MD5

55e753659670343038c9f8ecebf2ed3f
SHA1

76096cfdb3f80ca6fa74e61fad59d6d73a20108e
SHA256

d9b393cc9a9e8f84e9df308b9e931f4b25bdd34c6ea8db07b4df3f246bd5d2f8
SHA512

869c5752d8e13532bd129f65cd0933f33f3c41cd451c18ed19d68cff8a644078e85fd1e2d183be842e868f7d6c6caace5438e646d6e085ab85f68fca69bbe621
SSDEEP

24576:4y/4UiZTW//ao6BRm4hLKmVVTXBKo/KSg+yJJodI:4y/a1BRm4dKwVTRnsbodI

Score

7^/10

aspackv2 discovery

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b000000023b68-2.dat	aspack_v212_v242

Loads dropped DLL 2 IoCs

pid	Process
3152	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
3152	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\ = "NBRun Library"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ = "IBrowserToDelphiEvents"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ProgID\ = "NBRun.BrowserToDelphi"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\TypeLib	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\Clsid\ = "{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\FLAGS\ = "0"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ = "IBrowserToDelphi"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\Version = "1.0"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\LocalServer32	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\ProgID\ = "NBRun.NeoBookIEProtocol"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\FLAGS	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\ = "BrowserToDelphi Object"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\Clsid	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\Version = "1.0"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\Version = "1.0"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\Version = "1.0"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\ProgID	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0\win32	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ = "IBrowserToDelphi"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\Version\ = "1.0"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\Clsid	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ = "BrowserToDelphi Object"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ = "IBrowserToDelphiEvents"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\LocalServer32	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ProgID	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\Version	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\HELPDIR	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\Clsid\ = "{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}"	55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\55e753659670343038c9f8ecebf2ed3f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\94ED7D1D.nbp

Filesize
422KB

MD5
2fd0836d049bdffdc11d76b36732f3fb

SHA1
e751066f381525a4e2b892450fc00d90c60bb271

SHA256
26977cf094ec15191beef7268a41281a1fa0f22221c485ea8ccad9f7142d4445

SHA512
802b1cb9d2a129fa36968dde62539d76a265470e8a1db68d08877e83ba5c1101a7d24ec09198316cd15c37d1e54452fa643fcb4689a37c1b1183940ab642a46b

Download Submit
memory/3152-21-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-22-0x0000000002E10000-0x0000000002EFE000-memory.dmp

Filesize
952KB

Download
memory/3152-9-0x0000000002E10000-0x0000000002EFE000-memory.dmp

Filesize
952KB

Download
memory/3152-0-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/3152-11-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-13-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-15-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-17-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-10-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/3152-19-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-8-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-23-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-25-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-27-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-29-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-31-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-33-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/3152-36-0x0000000002E10000-0x0000000002EFE000-memory.dmp

Filesize
952KB

Download
memory/3152-35-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download