14673354ec7af29a9fb32ac852301d725d6689c0e446be27cb7f5dd2f4bbfd35

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe
Size

1.1MB
MD5

e2cb00e0034e74105420f0a7db345810
SHA1

544f71ea796e978ae1e75cdeedfd07948cab3a5f
SHA256

14673354ec7af29a9fb32ac852301d725d6689c0e446be27cb7f5dd2f4bbfd35
SHA512

4a091358d20ee84263ec3577fd23819047476c19cd293866e8825327247026a281968b75b21a98184080441b910846df8ca3dd961192c21e7817dc5c3defc8b9
SSDEEP

24576:L88g/MPwUI6iyh1DDjvxDEkTzlGr6WmhQry+EefXdXT0n+TQ:A8gEPwUI6iyDJDEkl7WmhkyB0FAwQ

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
804	000ORI~1.EXE
2500	000ORI~1.EXE

Loads dropped DLL 4 IoCs

pid	Process
2068	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe
2068	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe
804	000ORI~1.EXE
804	000ORI~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	000ORI~1.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSVBVM60.DLL	000ORI~1.EXE
File created	C:\Windows\SysWOW64\MSVBVM60.DLL	000ORI~1.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 804 set thread context of 2500	804	000ORI~1.EXE	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000ORI~1.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib\Version = "6.0"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib\Version = "6.0"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\ = "Hyperlink"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\TypeLib	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\TypeLib	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\TypeLib\Version = "6.0"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\TypeLib	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib\Version = "6.0"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\ProxyStubClsid32	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ProxyStubClsid32	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\ProxyStubClsid32	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL\\3"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ProxyStubClsid32	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\ = "_PropertyBag"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\ = "_Collection"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\ = "ContainedControls"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\ = "DataBindings"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\ProxyStubClsid32	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ = "AsyncProperty"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\ProxyStubClsid32	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\TypeLib	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\TypeLib\Version = "6.0"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\ = "AsyncProperty_VB5"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ = "_DDataBoundAndDataSourceClass"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\TypeLib\Version = "6.0"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\ProxyStubClsid32	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ = "DataObject"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\Version = "6.0"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\TypeLib\Version = "6.0"	000ORI~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\ = "DataMembers"	000ORI~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ProxyStubClsid32	000ORI~1.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
804	000ORI~1.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 804	2068	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe	30
PID 2068 wrote to memory of 804	2068	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe	30
PID 2068 wrote to memory of 804	2068	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe	30
PID 2068 wrote to memory of 804	2068	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe	30
PID 2068 wrote to memory of 804	2068	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe	30
PID 2068 wrote to memory of 804	2068	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe	30
PID 2068 wrote to memory of 804	2068	JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe	30
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31
PID 804 wrote to memory of 2500	804	000ORI~1.EXE	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2cb00e0034e74105420f0a7db345810.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\000ORI~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\000ORI~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\000ORI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\000ORI~1.EXE
    3⤵
    - Executes dropped EXE
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\000ORI~1.EXE

Filesize
896KB

MD5
8fdc4c7d5de01b10aadedad6cf42d9cc

SHA1
3460764e7ae92021737ba0c2195df6839a4275d4

SHA256
c62577743f4baeaa10e9b851c7ec813152a62ccccbbd259f40201717d7b6977d

SHA512
034359eb8ea882bd8fc4a0e8ef796a7c9fe0646a4f4a0360f24c647d10343bafa9c35b47f057232ab0672ef658539a04c2bc5e04f00a5015077e75012531aa02

Download Submit
memory/804-18-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/804-15-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/804-20-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/804-14-0x00000000004DA000-0x00000000004DB000-memory.dmp

Filesize
4KB

Download
memory/804-37-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/804-17-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/804-16-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/804-13-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/2068-9-0x00000000009B0000-0x0000000000AE4000-memory.dmp

Filesize
1.2MB

Download
memory/2068-10-0x00000000009B0000-0x0000000000AE4000-memory.dmp

Filesize
1.2MB

Download
memory/2500-33-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2500-31-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2500-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2500-27-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2500-25-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2500-23-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2500-35-0x0000000000400000-0x0000000000402800-memory.dmp

Filesize
10KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads