Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21/10/2024, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
663875e015dd282302a9cac9ab98104b_JaffaCakes118.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
663875e015dd282302a9cac9ab98104b_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
663875e015dd282302a9cac9ab98104b_JaffaCakes118.dll
-
Size
332KB
-
MD5
663875e015dd282302a9cac9ab98104b
-
SHA1
9713ff0dda9aabca3fac9fcc393135166e11e03e
-
SHA256
7fa7565e111626b66a5369ad3a19945dcc2a42c951c86aaeba12435734d059d1
-
SHA512
8f685ac037efe1e538ed843c0c0c2107b5291faaee1f49104021f73ebdbe300a51c6d94df3f942bb0180dcd8c5c67010376a5b8c46aa4a2fc799348dcb37670e
-
SSDEEP
6144:JdnEhp9wz7bbNFGqVPirWVf6uLJ0Q+Q7jkRrED7I0PNOT:JZEhszXbNFUrCNLJl7kJEQ0
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 1824 tim.exe -
Executes dropped EXE 1 IoCs
pid Process 1824 tim.exe -
Loads dropped DLL 2 IoCs
pid Process 2516 rundll32.exe 2516 rundll32.exe -
Modifies system executable filetype association 2 TTPs 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\open tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\open\command tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\ = "Application" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\DefaultIcon tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\runas\command tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\DefaultIcon\ = "%1" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\runas tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\start tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\start\command tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\Content Type = "application/x-msdownload" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\tim.exe\" -a \"%1\" %*" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" tim.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\WINDOWS\\system32\\ctfmon.exe" tim.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tim.exe -
Modifies registry class 41 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\start\command\IsolatedCommand = "\"%1\" %*" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\open tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\ = "exefile" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\runas tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\runas\command tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\start tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\Content Type = "application/x-msdownload" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\DefaultIcon tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\tim.exe\" -a \"%1\" %*" tim.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\DefaultIcon\ = "%1" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\DefaultIcon\ = "%1" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\runas\command tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\start tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\open\command tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\start\command tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\start\command\ = "\"%1\" %*" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\DefaultIcon tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\open\command tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\open tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\tim.exe\" -a \"%1\" %*" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\ = "Application" tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\runas tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\start\command tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\Content Type = "application/x-msdownload" tim.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\.exe\shell tim.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" tim.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 1824 tim.exe 1824 tim.exe 1824 tim.exe 1824 tim.exe 1824 tim.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2100 explorer.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 1824 tim.exe 1824 tim.exe 1824 tim.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 1824 tim.exe 2100 explorer.exe 2100 explorer.exe 1824 tim.exe 1824 tim.exe 2100 explorer.exe -
Suspicious use of SendNotifyMessage 19 IoCs
pid Process 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 2100 explorer.exe 1824 tim.exe 1824 tim.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1824 tim.exe 1824 tim.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2516 2528 rundll32.exe 31 PID 2528 wrote to memory of 2516 2528 rundll32.exe 31 PID 2528 wrote to memory of 2516 2528 rundll32.exe 31 PID 2528 wrote to memory of 2516 2528 rundll32.exe 31 PID 2528 wrote to memory of 2516 2528 rundll32.exe 31 PID 2528 wrote to memory of 2516 2528 rundll32.exe 31 PID 2528 wrote to memory of 2516 2528 rundll32.exe 31 PID 2516 wrote to memory of 1824 2516 rundll32.exe 32 PID 2516 wrote to memory of 1824 2516 rundll32.exe 32 PID 2516 wrote to memory of 1824 2516 rundll32.exe 32 PID 2516 wrote to memory of 1824 2516 rundll32.exe 32 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\663875e015dd282302a9cac9ab98104b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\663875e015dd282302a9cac9ab98104b_JaffaCakes118.dll,#12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\tim.exe"C:\Users\Admin\AppData\Local\tim.exe" -gav C:\Users\Admin\AppData\Local\Temp\663875e015dd282302a9cac9ab98104b_JaffaCakes118.dll3⤵
- Deletes itself
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1824
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2100
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD5d5dea36c443b95deac1280b776bbe122
SHA103043bb6dffb1ab1798a3ca7ef7d6a043d3758f3
SHA256bbf14a4ab1513dfa19932d3db7622bae2729dfdea6ff6efc0bd87cd668113105
SHA51239ad3b86403b9cb7113a1c571295da6363ae246d9d2edcbd6ba39cc45d7e9f2bf169602e766a260871b9135c24418deed77ad1db8bce7e431d27bad731665999