de19678737ca10a9a57ea6074c0b7a819c2a170850062d85dcf9dad6cc668ade

Analysis

max time kernel
93s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 20:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Size 78KB
Sample250127-zkncbsvmax
SHA256 de19678737ca10a9a57ea6074c0b7a819c2a170850062d85dcf9dad6cc668ade
MD5 438955525d3f7712570ab37641915bcc
SHA1 dd2d9b69314a2cb8a6b0ade91ec122eeb33fc744
SHA512 02189341413890d450c9347795229b998621a3668ac692ee579e265431f391c3a976451cec986f8fa6aa1b7ebe38864120543ec020bb4116f254d25bd4e15a95
SSDEEP 1536:HD9kNuNMSkRDlALvBYzQn1fskKWIo1K85XAcXoXicXoXeV:j94IklALJf0WIo1K85XAc4Sc4OV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3616	DelB258.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DelB258.tmp

Modifies registry class 50 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InfoTip = "淘宝新品折扣频道"	DelB258.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32\ = "C:\\WINDOWS\\SysWow64\\shdocvw.dll"	DelB258.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\ = "NoAddOns"	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\NoAddOns	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns	DelB258.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32\ThreadingModel = "Apartment"	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\NoAddOns\Command	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\LocalizedString = "淘宝特卖"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns\Command	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\NoAddOns	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\ = "NoAddOns"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\LocalizedString = "淘宝特卖"	DelB258.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\NoAddOns\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://%%73%%65%%72%%76%%65%%72%%33%%38%%2E%%32%%30%%31%%30%%70%%6C%%61%%79%%65%%72%%2E%%69%%6E%%66%%6F:459/?i=2"	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\Attributes = "0"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\DefaultIcon	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns\Command	DelB258.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\NoAddOns\MUIVerb = "@shdoclc.dll,-10241"	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InfoTip = "淘宝新品折扣频道"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32\ThreadingModel = "Apartment"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\NoAddOns\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://%%73%%65%%72%%76%%65%%72%%33%%38%%2E%%32%%30%%31%%30%%70%%6C%%61%%79%%65%%72%%2E%%69%%6E%%66%%6F:459/?i=2"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\NoAddOns\Command	DelB258.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder\Attributes = "0"	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\DefaultIcon	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\NoAddOns\ = "打开主页(&H)"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\NoAddOns\MUIVerb = "@shdoclc.dll,-10241"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32	DelB258.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon\ = "%SystemRoot%\\SysWow64\\taobao.ico"	DelB258.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\NoAddOns\ = "打开主页(&H)"	DelB258.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\DefaultIcon\ = "%SystemRoot%\\SysWow64\\taobao.ico"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32\ = "C:\\WINDOWS\\SysWow64\\shdocvw.dll"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder	DelB258.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}	DelB258.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3616	1524	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe	84
PID 1524 wrote to memory of 3616	1524	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe	84
PID 1524 wrote to memory of 3616	1524	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe	84

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon = "1"	JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon = "1"	DelB258.tmp

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_438955525d3f7712570ab37641915bcc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_438955525d3f7712570ab37641915bcc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1524
- C:\Users\Admin\AppData\Local\Temp\DelB258.tmp
  C:\Users\Admin\AppData\Local\Temp\DelB258.tmp 1108 "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_438955525d3f7712570ab37641915bcc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DelB258.tmp

Path C:\Users\Admin\AppData\Local\Temp\DelB258.tmp
Size 78KB
SHA256 de19678737ca10a9a57ea6074c0b7a819c2a170850062d85dcf9dad6cc668ade
MD5 438955525d3f7712570ab37641915bcc
SHA1 dd2d9b69314a2cb8a6b0ade91ec122eeb33fc744
SHA512 02189341413890d450c9347795229b998621a3668ac692ee579e265431f391c3a976451cec986f8fa6aa1b7ebe38864120543ec020bb4116f254d25bd4e15a95
SSDEEP 1536:HD9kNuNMSkRDlALvBYzQn1fskKWIo1K85XAcXoXicXoXeV:j94IklALJf0WIo1K85XAc4Sc4OV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Internet Explorer.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk
Size 1KB
SHA256 34b6f0fddfcff9b493b2ea79518c3bb55427750c1f25e27e59bd77acf15dcb08
MD5 935e7535b0b0e035cce43144e6b23b26
SHA1 d42b625d391565e4b700e5937fd78c6057fe006a
SHA512 cac7f7a81d779b81c66f883b1d73de90921eb94b636ddb28a9cb52f3368b0dcab7e3d73ce94383b1a2620fa4ba4941133d0dfe9fb52988c8594ac5e0018b19b0
MD5 SHA1 SHA512