Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exe
-
Size
13KB
-
MD5
4394101d29bd57686b458ce2b4cbffff
-
SHA1
e5e39839d64316bc953ec65834fbd6ada0fd7218
-
SHA256
ed3e3dbaae5139050b8cd1cb61ecbe18a911900275692eadc384544639c6db9d
-
SHA512
092f78b4998ee56f13c5316f7af5c630926ab8723e5c854c96df8b640e190155ad0418bb941afbf3725fc32fa8a4567ccf0d1a2287a1d415ae698c96233f0ab8
-
SSDEEP
192:DmGwWlwFtGnHpAcZPJJhc2l7NPnEZQuPPp0+:DKWotQpDZPJfFt5EXPPp0+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{58696D3D-DD67-11EF-91C3-CAF61997B0B0} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "752179947" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a1688e4e155de14da446578e2f62162100000000020000000000106600000001000020000000bdef4682150121ce90de1b180bed39f7c619e0c3584a051ea6535a6f0456d5c9000000000e8000000002000020000000d7e23ff8c4150dd0acd9daefb5fa2d31633bac5b222c220d836464e2d8c85888200000009118cff4268d572b7b8e96331045bd1309fddcbecd4b08408ec68b06d719fcfa40000000c0f4eddee9851aa013396538f5c96ff999292454e2bc04c9045b0d81787566bab7c8fecac2c6f3686e5b546e6d50bf291638793c33039fda7ad835c8d35845a5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31158644" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a1688e4e155de14da446578e2f62162100000000020000000000106600000001000020000000c869c67b8dea88edbe25bbf1f088f6ae5ac95fb362c3ff440e1c767ac5ca7220000000000e800000000200002000000063c8da4c4af43d8801d7f08a8b6c5b29e8e6a3756d5849f2d05f4ed3662816e6200000006b86271918d6b1554f49d926c072cbb628c162ea7a72326ccd5edbe9a22693bf4000000046d392e43abad43d5f68b235d9b5e450b53866386ee985b91bd8cde4f517144fe371e559c6af6b4ea60fe988124ecb47324d70946db88e9e4f0ea894c118eb17 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cbab2d7471db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31158644" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e49f2d7471db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "756554824" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444827115" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3528 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3528 iexplore.exe 3528 iexplore.exe 4960 IEXPLORE.EXE 4960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4992 wrote to memory of 2752 4992 JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exe 83 PID 4992 wrote to memory of 2752 4992 JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exe 83 PID 4992 wrote to memory of 2752 4992 JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exe 83 PID 3528 wrote to memory of 4960 3528 iexplore.exe 86 PID 3528 wrote to memory of 4960 3528 iexplore.exe 86 PID 3528 wrote to memory of 4960 3528 iexplore.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4394101d29bd57686b458ce2b4cbffff.exe2⤵PID:2752
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:4828
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3528 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5475c66b9af3c16540234fd08c8b64ee1
SHA1fbf3a350a46429077838d755006c4c2f8e0aab7d
SHA2563f31d71c018f407fc7b46a5ccd3ab6a8473359fec94505232a3d2a8c86f30e7f
SHA512fef96a645b5c74823d8ccc53069847b71437cd083851bcb11791cb7ebe4975806253abc6068d12dd5238920682304862c01ae1f4a0e0a1c2b0bd9af2e515a846
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD541651a1ab559bb546da993167b959fb0
SHA16d374a5c46e8446eda3b0b145a70005dc34d2408
SHA256444eb0c5e2a9103f477684988a0c35363b93ee215422e015fcf7fa898a749214
SHA5122890a47e5d02236e1b5903865b08cbca5c4cee8548081d881afbadcc3e904f907df0da0ef72644c58db7aed91f29f4a8092097c4bc9fa79d8a14512ab1cb0a91
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee