Analysis
-
max time kernel
127s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 06:25
Static task
static1
Behavioral task
behavioral1
Sample
191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe
-
Size
355KB
-
MD5
191bfbe9c5e47b8736a7829834006e37
-
SHA1
7b22cdc9ea3b7e8c3e88656973d9f27796bcdad8
-
SHA256
c6628f4091e5f7d7b9292e707ec606a8f3085402e2fb1c406553b2454871e8b7
-
SHA512
853fe256e3010e32379c3774bf4e121e88ba92f1b1d290241e3c316547efaf9d62cb2558feddef8ce434dbcc72e100e6891fc3cdf20ef6023b4397bf89c7af03
-
SSDEEP
6144:D5BgvadeLnJiYZ+up5BmmbKaRwmNN5rWlBtCAA6LoFAPo:D//miwZ/JKqW3tjsZ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exeWaterMark.exepid process 3636 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe 1968 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/3636-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3636-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3636-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1968-24-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1968-29-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3636-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3636-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3636-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3636-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1968-36-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxE3C8.tmp 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4452 3532 WerFault.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "321289914" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115556" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "321289914" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3EAEA5DB-3517-11EF-B8C0-EABD73F69B33} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "320040243" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115556" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115556" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426320917" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "320040243" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115556" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe 1968 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 1968 WaterMark.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4900 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exeiexplore.exeIEXPLORE.EXEpid process 4232 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe 4232 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe 4232 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe 4900 iexplore.exe 4900 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exeWaterMark.exepid process 3636 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe 1968 WaterMark.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exeWaterMark.exeiexplore.exedescription pid process target process PID 4232 wrote to memory of 3636 4232 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe PID 4232 wrote to memory of 3636 4232 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe PID 4232 wrote to memory of 3636 4232 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe PID 3636 wrote to memory of 1968 3636 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe WaterMark.exe PID 3636 wrote to memory of 1968 3636 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe WaterMark.exe PID 3636 wrote to memory of 1968 3636 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe WaterMark.exe PID 1968 wrote to memory of 3532 1968 WaterMark.exe svchost.exe PID 1968 wrote to memory of 3532 1968 WaterMark.exe svchost.exe PID 1968 wrote to memory of 3532 1968 WaterMark.exe svchost.exe PID 1968 wrote to memory of 3532 1968 WaterMark.exe svchost.exe PID 1968 wrote to memory of 3532 1968 WaterMark.exe svchost.exe PID 1968 wrote to memory of 3532 1968 WaterMark.exe svchost.exe PID 1968 wrote to memory of 3532 1968 WaterMark.exe svchost.exe PID 1968 wrote to memory of 3532 1968 WaterMark.exe svchost.exe PID 1968 wrote to memory of 3532 1968 WaterMark.exe svchost.exe PID 4232 wrote to memory of 2368 4232 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe splwow64.exe PID 4232 wrote to memory of 2368 4232 191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe splwow64.exe PID 1968 wrote to memory of 4900 1968 WaterMark.exe iexplore.exe PID 1968 wrote to memory of 4900 1968 WaterMark.exe iexplore.exe PID 1968 wrote to memory of 2800 1968 WaterMark.exe iexplore.exe PID 1968 wrote to memory of 2800 1968 WaterMark.exe iexplore.exe PID 4900 wrote to memory of 3016 4900 iexplore.exe IEXPLORE.EXE PID 4900 wrote to memory of 3016 4900 iexplore.exe IEXPLORE.EXE PID 4900 wrote to memory of 3016 4900 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\191bfbe9c5e47b8736a7829834006e37_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 2045⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4900 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3532 -ip 35321⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4332,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5fa34ecb8815a2d98849888cb1cdbf38b
SHA184fd0e04586009efb3683c98da8d9aa41487cd42
SHA2565077a54924f80491a74ed78bbd73ff7bf85a27caddb80ceaa9ccb86f8b9a11be
SHA512ccfdb76ccedd0076601e17272d346229e2b9c0dd884c09bb7701b32c5dc177da8a91bb539ce751297d8ea44716fc497e8a337a9499c93a474ba85915f28f1053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD56afcebaab50c6f7b6607d4f951ac1a1c
SHA1b87a07164f5942c260a5ca86633139ced004356d
SHA2563c6745f61307872f88c203b651aa5ee02eb01084919084448adc162966ff5904
SHA512e9bd4760d18ea1eee9bced752c0c980944aa72f46edc3192c3a57d3d4d0acdc189f00dca05d6d03a96638f4422404d7f55adde26ad4a90f4ff61a30d58dfb7ae
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver66B4.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\191bfbe9c5e47b8736a7829834006e37_JaffaCakes118mgr.exeFilesize
139KB
MD503f2a314cd1c598c38a1de2663e1aebb
SHA1aff058f29943df223cc418ed6544ab0f176e5762
SHA25664ff2387190101102b4f140065c12780ea9ad822a1c05444a552164cc30a3392
SHA512950368f5a8eacdee919ca7d2c93c1939f9fc120602fd7347e16ae6a67e382cec7b2525adc652ac2ce39e08a614437248d1ff83d44171075ce8333016bf45ae45
-
memory/1968-36-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1968-34-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/1968-28-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1968-24-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1968-30-0x0000000076F32000-0x0000000076F33000-memory.dmpFilesize
4KB
-
memory/1968-29-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3532-33-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/3532-32-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/3636-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3636-14-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB
-
memory/3636-7-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3636-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3636-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3636-9-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3636-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3636-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3636-5-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4232-0-0x0000000001000000-0x000000000105D000-memory.dmpFilesize
372KB
-
memory/4232-60-0x0000000001000000-0x000000000105D000-memory.dmpFilesize
372KB