Analysis
-
max time kernel
142s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 19:39
Static task
static1
Behavioral task
behavioral1
Sample
1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe
-
Size
95KB
-
MD5
1747bd6ec5a7f0885dd83f81bf5e217d
-
SHA1
561ffdedb67a0099b1cf234cf0eb8afaacf49a04
-
SHA256
de5f9b20738114231dac80a55bc3e0f2f1e2e7d27a84cf98f171aff34de05838
-
SHA512
461a20c9c23a54cbb22c65b975ca420aa0d2033d451ed494f6dc25e6969059ba9fda6523b4a78bff78bee137f27b3af84621d0f3b45c15f2033243dfea6368d4
-
SSDEEP
768:W06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:0R0vxn3Pc0LCH9MtbvabUDzJYWu3B
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WaterMark.exepid process 2672 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/4504-5-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4504-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4504-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4504-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4504-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4504-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4504-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4504-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2672-26-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2672-25-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2672-36-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/2672-35-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/2672-37-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2672-39-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px3479.tmp 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 220 2320 WerFault.exe svchost.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115465" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1553B579-34BD-11EF-B9F7-CE945492B8DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115465" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3932432483" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115465" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426282195" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3932432483" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3954463370" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe 2672 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 2672 WaterMark.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2380 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2380 iexplore.exe 2380 iexplore.exe 5076 IEXPLORE.EXE 5076 IEXPLORE.EXE 5076 IEXPLORE.EXE 5076 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exeWaterMark.exepid process 4504 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe 2672 WaterMark.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exeWaterMark.exeiexplore.exedescription pid process target process PID 4504 wrote to memory of 2672 4504 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe WaterMark.exe PID 4504 wrote to memory of 2672 4504 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe WaterMark.exe PID 4504 wrote to memory of 2672 4504 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe WaterMark.exe PID 2672 wrote to memory of 2320 2672 WaterMark.exe svchost.exe PID 2672 wrote to memory of 2320 2672 WaterMark.exe svchost.exe PID 2672 wrote to memory of 2320 2672 WaterMark.exe svchost.exe PID 2672 wrote to memory of 2320 2672 WaterMark.exe svchost.exe PID 2672 wrote to memory of 2320 2672 WaterMark.exe svchost.exe PID 2672 wrote to memory of 2320 2672 WaterMark.exe svchost.exe PID 2672 wrote to memory of 2320 2672 WaterMark.exe svchost.exe PID 2672 wrote to memory of 2320 2672 WaterMark.exe svchost.exe PID 2672 wrote to memory of 2320 2672 WaterMark.exe svchost.exe PID 2672 wrote to memory of 464 2672 WaterMark.exe iexplore.exe PID 2672 wrote to memory of 464 2672 WaterMark.exe iexplore.exe PID 2672 wrote to memory of 2380 2672 WaterMark.exe iexplore.exe PID 2672 wrote to memory of 2380 2672 WaterMark.exe iexplore.exe PID 2380 wrote to memory of 5076 2380 iexplore.exe IEXPLORE.EXE PID 2380 wrote to memory of 5076 2380 iexplore.exe IEXPLORE.EXE PID 2380 wrote to memory of 5076 2380 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 2044⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2320 -ip 23201⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5240 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
95KB
MD51747bd6ec5a7f0885dd83f81bf5e217d
SHA1561ffdedb67a0099b1cf234cf0eb8afaacf49a04
SHA256de5f9b20738114231dac80a55bc3e0f2f1e2e7d27a84cf98f171aff34de05838
SHA512461a20c9c23a54cbb22c65b975ca420aa0d2033d451ed494f6dc25e6969059ba9fda6523b4a78bff78bee137f27b3af84621d0f3b45c15f2033243dfea6368d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5fa34ecb8815a2d98849888cb1cdbf38b
SHA184fd0e04586009efb3683c98da8d9aa41487cd42
SHA2565077a54924f80491a74ed78bbd73ff7bf85a27caddb80ceaa9ccb86f8b9a11be
SHA512ccfdb76ccedd0076601e17272d346229e2b9c0dd884c09bb7701b32c5dc177da8a91bb539ce751297d8ea44716fc497e8a337a9499c93a474ba85915f28f1053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD572bcd9a83e08339b6c3d8c8a81637767
SHA1581424abf7b1ccdbd704a81a7acc728177547cf7
SHA2569de12d17a6e10b82067e9c60a11a67f47f9cbf676559a8d42cab2488e3fc1552
SHA5126f5004fddb9a77e0b63357cca15d9afb4a61b97ba7812b1a80cc980677bcf37682f0cda5d421003b2cd813adf3c8dcbd3554349221b3ed79e172e8f20c71cca5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
memory/2320-30-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/2320-31-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/2672-33-0x00000000779F2000-0x00000000779F3000-memory.dmpFilesize
4KB
-
memory/2672-34-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2672-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2672-37-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2672-35-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2672-36-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2672-28-0x00000000779F2000-0x00000000779F3000-memory.dmpFilesize
4KB
-
memory/2672-17-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2672-22-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2672-26-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2672-25-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2672-27-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/4504-4-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4504-3-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4504-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4504-0-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4504-7-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4504-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4504-11-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/4504-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4504-9-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4504-5-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4504-2-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4504-1-0x0000000000401000-0x0000000000402000-memory.dmpFilesize
4KB