Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 06:39
Static task
static1
Behavioral task
behavioral1
Sample
19256bd12b5a792b34f795d902744001_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
19256bd12b5a792b34f795d902744001_JaffaCakes118.exe
-
Size
87KB
-
MD5
19256bd12b5a792b34f795d902744001
-
SHA1
050228507ddcc182dc15c34f2d5ca28e8aabfaa3
-
SHA256
4ac41d74455939bdb93f0278d8def69e8a7731066766208833a83e3cafefe21d
-
SHA512
05ecea31633d84ec3874ede6f69a0598180bdb14c65a856d71bf8d341bcb997adf3a9bcec969ed39dcffd47bc612d896f8ca3ec3eee5f493ab554575bcb0c06c
-
SSDEEP
1536:UikAwHxzZh2UXYmvdRmSZad2jN0RAJGWanGjPEep3KJ:xkAwRzhjdRmSZiANP8J
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1532-3-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1532-4-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1532-8-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1532-7-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1532-5-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1532-2-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1532-1-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1532-11-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115557" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{220D53E3-3519-11EF-A084-C2BABBD8D0A3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4134829136" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115557" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4134829136" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426321728" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115557" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4136860553" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
19256bd12b5a792b34f795d902744001_JaffaCakes118.exepid process 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
19256bd12b5a792b34f795d902744001_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4592 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4592 iexplore.exe 4592 iexplore.exe 4824 IEXPLORE.EXE 4824 IEXPLORE.EXE 4824 IEXPLORE.EXE 4824 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
19256bd12b5a792b34f795d902744001_JaffaCakes118.exepid process 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
19256bd12b5a792b34f795d902744001_JaffaCakes118.exeiexplore.exedescription pid process target process PID 1532 wrote to memory of 4592 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe iexplore.exe PID 1532 wrote to memory of 4592 1532 19256bd12b5a792b34f795d902744001_JaffaCakes118.exe iexplore.exe PID 4592 wrote to memory of 4824 4592 iexplore.exe IEXPLORE.EXE PID 4592 wrote to memory of 4824 4592 iexplore.exe IEXPLORE.EXE PID 4592 wrote to memory of 4824 4592 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\19256bd12b5a792b34f795d902744001_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19256bd12b5a792b34f795d902744001_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4592 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5fa34ecb8815a2d98849888cb1cdbf38b
SHA184fd0e04586009efb3683c98da8d9aa41487cd42
SHA2565077a54924f80491a74ed78bbd73ff7bf85a27caddb80ceaa9ccb86f8b9a11be
SHA512ccfdb76ccedd0076601e17272d346229e2b9c0dd884c09bb7701b32c5dc177da8a91bb539ce751297d8ea44716fc497e8a337a9499c93a474ba85915f28f1053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5d48852da574f9ea5cd5001c2b7db9d7b
SHA14908bf3810cbf8d8f35a23d894b50559c062dd8c
SHA256e1ca7bd375d23b30ba6b0074ce336888c5a60f8a5bd66e0dfa4225d102b2a40b
SHA512f789e4013b587484b996b898ecd99c4566f1e99f537450642c79db62266eda57be17de05edebd7d1956ce227f7be95d236b150b27d7d0ecbd635d4f3c82b4a00
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
memory/1532-5-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1532-8-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1532-7-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1532-0-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1532-2-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1532-1-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1532-10-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1532-11-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1532-12-0x0000000077302000-0x0000000077303000-memory.dmpFilesize
4KB
-
memory/1532-9-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/1532-4-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1532-3-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB