Analysis
-
max time kernel
136s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 01:13
Static task
static1
Behavioral task
behavioral1
Sample
80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe
-
Size
581KB
-
MD5
80fc7464938eecb59386e65898b56e7f
-
SHA1
6dc880153500ab7359090c2d1256d38651b85f14
-
SHA256
eabc70968d6828deb319a3dcf934bf5ddad355b8f3f065a8e95363f554876908
-
SHA512
cf9cec379dce3c99efa6d76270064c345376684c7c211a5bf2ea5088613dc5d296e4bb26a22a05b56c1197671be9a9781b1e5d0cd8b7f0d3842929d75448557c
-
SSDEEP
12288:uoMDtCi7NFlZnNqZ9xGrLpZ0ZHEqtgb0U7:ufplNFgxG5eZngb0s
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation nbfile1.exe -
Executes dropped EXE 2 IoCs
pid Process 3180 nbfile0.exe 4468 nbfile1.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbfile0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbfile1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b93-17.dat nsis_installer_2 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31140670" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2519065719" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31140670" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c88e6291f50dd448b150439a5f2f5a3d0000000002000000000010660000000100002000000078afbaf0a42d7bbc1d0b18b13f08db6ad1967ae36f1a9a04495ff06f04c6c8c9000000000e8000000002000020000000ffc78ff952479cdab181978b3ae2c6c10de58487959bafb23111204afa36bd1d200000000d42536f5b3c7a4053343af4661d4ca718835cb1ab2bda90e0b2e2f450738af74000000045d6fa6a96fbb1362b34d622aaf41c33be5394d726efeec09315a4636cc4799e7146a2f87897c054792b3c538428d97ed1fa202b11aea2ee78ee1a28ee0a118f IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2514690987" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5013b0963e2bdb01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C168E4C8-9731-11EF-BEF1-D2BD7E71DA05} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403fb7963e2bdb01 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437107517" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2514690987" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c88e6291f50dd448b150439a5f2f5a3d000000000200000000001066000000010000200000005cc8a8dfb1e1e044d99e75dfd84f946b98724662e96c829ce6be4721a8c968c4000000000e8000000002000020000000dcb6cae0a4047704cfeaef4b2959cdb0381796f81fd7401b35116e22e5fb285a20000000131a47ff90bcf59e8bae647f11d46679e14b46c14ef0f35462d4dd7a26338c3b40000000510e612baaa4070c80f29ca5cd19230af6364df0e20cb6a02efcdb3f62f26e44ea3d212d1a5e524b79bcad03c459f8c8b7303c9af93ca89c65ca77fe7afbc22c IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31140670" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings nbfile1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3180 nbfile0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 316 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3180 nbfile0.exe 316 IEXPLORE.EXE 316 IEXPLORE.EXE 3900 IEXPLORE.EXE 3900 IEXPLORE.EXE 3900 IEXPLORE.EXE 3900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4680 wrote to memory of 3180 4680 80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3180 4680 80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe 84 PID 4680 wrote to memory of 3180 4680 80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe 84 PID 3180 wrote to memory of 316 3180 nbfile0.exe 85 PID 3180 wrote to memory of 316 3180 nbfile0.exe 85 PID 316 wrote to memory of 3900 316 IEXPLORE.EXE 86 PID 316 wrote to memory of 3900 316 IEXPLORE.EXE 86 PID 316 wrote to memory of 3900 316 IEXPLORE.EXE 86 PID 3180 wrote to memory of 1468 3180 nbfile0.exe 90 PID 3180 wrote to memory of 1468 3180 nbfile0.exe 90 PID 3180 wrote to memory of 1468 3180 nbfile0.exe 90 PID 4680 wrote to memory of 4468 4680 80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe 91 PID 4680 wrote to memory of 4468 4680 80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe 91 PID 4680 wrote to memory of 4468 4680 80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe 91 PID 4468 wrote to memory of 2448 4468 nbfile1.exe 92 PID 4468 wrote to memory of 2448 4468 nbfile1.exe 92 PID 4468 wrote to memory of 2448 4468 nbfile1.exe 92 PID 4468 wrote to memory of 3188 4468 nbfile1.exe 93 PID 4468 wrote to memory of 3188 4468 nbfile1.exe 93 PID 4468 wrote to memory of 3188 4468 nbfile1.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\80fc7464938eecb59386e65898b56e7f_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\nbfile0.exeC:\Users\Admin\AppData\Local\Temp\nbfile0.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.97199.com/install2/?sl33⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:316 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\nbfile0.exe3⤵
- System Location Discovery: System Language Discovery
PID:1468
-
-
-
C:\Users\Admin\AppData\Local\Temp\nbfile1.exeC:\Users\Admin\AppData\Local\Temp\nbfile1.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\newsetup.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:2448
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\1.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:3188
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5ee4ada789158c1e5a14d597cf1d5edd0
SHA19593aee78d30d51ab93d6a29dc4dc873e0d466b6
SHA256903a6d82bf2fe8951104cf90d9f64aab0fbded30a2246e678a80d07868569b4f
SHA512a6214f62e5089512aeaabab7c4bb38e8663fb55d5f4129c57e726723dad10802ec40c3dc836087713b77c1874c12f177bf2b2998fd3e52f4210c1c5307885c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5eb495911b32c5419c6e1c9f84108c332
SHA17668281d05bd89c6ade1a31aebc00143ca95b2c2
SHA256a31d4c84f26e3230d3a5f46fde02f225fc51341caeb15ad94e08103812e4a972
SHA512536a93b36a0c0c3bb9fdc9b10cbe4f1b8020a78372d08fe9069139a5dde92c9f81fc209911bccbb2cb4a8d363d0204a126edc77b92beab5f3c62bd5adb3b737d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
467KB
MD574869a0346ab36bbba85022612505121
SHA12cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a
SHA2566de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a
SHA512723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5
-
Filesize
52KB
MD5c4ddf11ebdbf9d8397d710d2cb4e2fab
SHA18008c97e7d6ff92deb3e1755a614f4afedca92b9
SHA25667a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6
SHA5123c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9
-
Filesize
651B
MD54736e7158c27f244482f5a614b9dbdae
SHA1d3a0e95a81e9e3ec95cfd596b25749a0e24e27b9
SHA256b8229bc8d6b0013858fb9599cb510afa4566a439164b2c7444c449540a124acc
SHA512cebf895dd3ec3822c42b78bac49c685b063cb5afcbcfb3850b073cb118d086c5fa75ec50b6e73d90e14f2c6b595752ad87910b8cf27378424d72a9ea309bf824