39f29584a80e19fa1f39d8262ba3677c76d64c40d92e85079db7e5b9e9005093

Analysis

max time kernel
131s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe
Size

150KB
MD5

3d3b0634022d4009f29f1e71efb4f160
SHA1

137a67335b81d58ffa85883bc8ca88c44dc93196
SHA256

39f29584a80e19fa1f39d8262ba3677c76d64c40d92e85079db7e5b9e9005093
SHA512

7d19be08ccccb407b2c93a8d311a87353fbbd76d98e1eb1f79dda2bbf234d568e3804b0b662e67a4a7a54e55775816a1c3ce454ea0b7dc2d38027020975e15fc
SSDEEP

3072:SxvyDuOYHEYzXd6cYKbWgbYkk0d/tV5dLzqgV:ByPkYx6VpQYkHd/tV5dLp

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	inlC507.tmp

Executes dropped EXE 2 IoCs

pid	Process
5088	ADD4.tmp
432	inlC507.tmp

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57c5f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57c5f4.msi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\Installer\e57c5f0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{665AFE7C-A245-48BE-9E7B-1C4E428F9BF4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC709.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
60	5088	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inlC507.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADD4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe
3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe
2304	msiexec.exe
2304	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5012	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5012	msiexec.exe
Token: SeSecurityPrivilege	2304	msiexec.exe
Token: SeCreateTokenPrivilege	5012	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5012	msiexec.exe
Token: SeLockMemoryPrivilege	5012	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5012	msiexec.exe
Token: SeMachineAccountPrivilege	5012	msiexec.exe
Token: SeTcbPrivilege	5012	msiexec.exe
Token: SeSecurityPrivilege	5012	msiexec.exe
Token: SeTakeOwnershipPrivilege	5012	msiexec.exe
Token: SeLoadDriverPrivilege	5012	msiexec.exe
Token: SeSystemProfilePrivilege	5012	msiexec.exe
Token: SeSystemtimePrivilege	5012	msiexec.exe
Token: SeProfSingleProcessPrivilege	5012	msiexec.exe
Token: SeIncBasePriorityPrivilege	5012	msiexec.exe
Token: SeCreatePagefilePrivilege	5012	msiexec.exe
Token: SeCreatePermanentPrivilege	5012	msiexec.exe
Token: SeBackupPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	5012	msiexec.exe
Token: SeShutdownPrivilege	5012	msiexec.exe
Token: SeDebugPrivilege	5012	msiexec.exe
Token: SeAuditPrivilege	5012	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5012	msiexec.exe
Token: SeChangeNotifyPrivilege	5012	msiexec.exe
Token: SeRemoteShutdownPrivilege	5012	msiexec.exe
Token: SeUndockPrivilege	5012	msiexec.exe
Token: SeSyncAgentPrivilege	5012	msiexec.exe
Token: SeEnableDelegationPrivilege	5012	msiexec.exe
Token: SeManageVolumePrivilege	5012	msiexec.exe
Token: SeImpersonatePrivilege	5012	msiexec.exe
Token: SeCreateGlobalPrivilege	5012	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeIncBasePriorityPrivilege	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 5088	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	89
PID 3740 wrote to memory of 5088	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	89
PID 3740 wrote to memory of 5088	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	89
PID 3740 wrote to memory of 5012	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	99
PID 3740 wrote to memory of 5012	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	99
PID 3740 wrote to memory of 5012	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	99
PID 3740 wrote to memory of 1500	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	103
PID 3740 wrote to memory of 1500	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	103
PID 3740 wrote to memory of 1500	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	103
PID 3740 wrote to memory of 4444	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	105
PID 3740 wrote to memory of 4444	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	105
PID 3740 wrote to memory of 4444	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	105
PID 3740 wrote to memory of 3576	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	106
PID 3740 wrote to memory of 3576	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	106
PID 3740 wrote to memory of 3576	3740	JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe	106
PID 2304 wrote to memory of 4396	2304	msiexec.exe	109
PID 2304 wrote to memory of 4396	2304	msiexec.exe	109
PID 2304 wrote to memory of 4396	2304	msiexec.exe	109
PID 4444 wrote to memory of 2396	4444	cmd.exe	110
PID 4444 wrote to memory of 2396	4444	cmd.exe	110
PID 4444 wrote to memory of 2396	4444	cmd.exe	110
PID 1500 wrote to memory of 432	1500	cmd.exe	111
PID 1500 wrote to memory of 432	1500	cmd.exe	111
PID 1500 wrote to memory of 432	1500	cmd.exe	111
PID 432 wrote to memory of 4424	432	inlC507.tmp	114
PID 432 wrote to memory of 4424	432	inlC507.tmp	114
PID 432 wrote to memory of 4424	432	inlC507.tmp	114

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3d3b0634022d4009f29f1e71efb4f160.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Roaming\ADD4.tmp
  C:\Users\Admin\AppData\Roaming\ADD4.tmp
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 264
    3⤵
    - Program crash
    PID:60
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INSC09~1.INI /quiet
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Users\Admin\AppData\Local\Temp\inlC507.tmp
    C:\Users\Admin\AppData\Local\Temp\inlC507.tmp cdf1912.tmp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inlC507.tmp > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\expand.exe
    expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 5088
1⤵
PID:3432

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA1CEE4DF775F223832187C196C245FA
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57c5f3.rbs

Filesize
8KB

MD5
479f9238ab64d2d84000f19122995b32

SHA1
1996fe8eeb667941978dde226332b92293306ef1

SHA256
e0d9acf92211a025f78b1c498326f26342ea15fa76b42992073218f200a26ccb

SHA512
6e5e6e8aa5b4a11ed540c07f4624a6158fa49c9e062f32c6105ad67d08d94946be682a3ef096a9dd0eda37118a1abc8245233ecf2c461384fd13eb1b1947535f

Download Submit
C:\Users\Admin\AppData\Local\Temp\INSC09~1.INI

Filesize
66KB

MD5
07cb73a0254732d24cb3d1d94e69a1d2

SHA1
e30f4f005dee433077a124af242098aec6ccfc6a

SHA256
594368b4abc46c23c99cb3f5b87fa562e26ef37bd6a50e0eb8b842fcb93b70e5

SHA512
75bd79950d8552df7242f933c72a963b1e90608b15968d6831e7872d1a0c3c3733c24dcb77d900797c8eef8b76773d9a77620b8ca798a5b34704e1f0ca79c4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
768B

MD5
d20d9eda31a2d0300e4589df7f352370

SHA1
79b46d2dbb489914cfedafdbc90e62951471b48e

SHA256
d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8

SHA512
d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

Filesize
57B

MD5
56b51de25a2a46e873e9d51b64dff882

SHA1
dbd28b0a91a176f007b8745d3ed83c9e135ae53f

SHA256
a020bf23df70242aefa978ca2ad40866ab074ac38105dded343968211aeeeee0

SHA512
b57bfa2e3b980f4af1c47f5b4c129dec5938f36f7885864b24bd3bd723610296a2922d6501836b96a1831eb5aacb77f6cbd5e3ec57ac7bf04c87fd8821e5f860

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

Filesize
98B

MD5
8663de6fce9208b795dc913d1a6a3f5b

SHA1
882193f208cf012eaf22eeaa4fef3b67e7c67c15

SHA256
2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61

SHA512
9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

Download Submit
\??\c:\users\admin\appdata\local\temp\favorites_url.cab

Filesize
425B

MD5
da68bc3b7c3525670a04366bc55629f5

SHA1
15fda47ecfead7db8f7aee6ca7570138ba7f1b71

SHA256
73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5

SHA512
6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

Download Submit
memory/432-76-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3740-32-0x00000000001A0000-0x00000000001A3000-memory.dmp

Filesize
12KB

Download
memory/3740-31-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3740-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3740-1-0x00000000001A0000-0x00000000001A3000-memory.dmp

Filesize
12KB

Download
memory/5088-12-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/5088-10-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/5088-8-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download