Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 06:50
Static task
static1
Behavioral task
behavioral1
Sample
192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe
-
Size
166KB
-
MD5
192e139015c44fbc67b75a89abe99a86
-
SHA1
15599b909247601fbb064a7c27c8151aae1d6a6c
-
SHA256
7c547ff815f4f818f2f52ce61ecbfc00131167990209ff21c4a224888455fea6
-
SHA512
879e617162390934c36d513936615171a8f99f9ca4ea922420779e33a4f8fe22f6f4da5eb2f2410940fa16fbadcec4ddef8f3549bcb5b1b06fef0994fa833f50
-
SSDEEP
1536:5NpbWTono2PF9yJH9KBjH7ZoSQoL+Qz6AdvaLj30b9KVv6q7pbhD3fdaAsU3wNBz:wdKFOoL16Ady330wN6qb3MAxwgKaM
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exeWaterMark.exepid process 316 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe 4080 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/316-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/316-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4080-28-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4080-25-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/316-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/316-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/316-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/316-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4080-31-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/316-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4080-37-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px48FF.tmp 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 936 2824 WerFault.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C77E9CD2-351A-11EF-A084-C2BABBD8D0A3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2614901875" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115559" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115559" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2616776901" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426322434" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2614901875" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115559" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe 4080 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 4080 WaterMark.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2068 iexplore.exe 2068 iexplore.exe 4328 IEXPLORE.EXE 4328 IEXPLORE.EXE 4328 IEXPLORE.EXE 4328 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exeWaterMark.exepid process 316 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe 4080 WaterMark.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exeWaterMark.exeiexplore.exedescription pid process target process PID 1500 wrote to memory of 316 1500 192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe PID 1500 wrote to memory of 316 1500 192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe PID 1500 wrote to memory of 316 1500 192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe PID 316 wrote to memory of 4080 316 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe WaterMark.exe PID 316 wrote to memory of 4080 316 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe WaterMark.exe PID 316 wrote to memory of 4080 316 192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe WaterMark.exe PID 4080 wrote to memory of 2824 4080 WaterMark.exe svchost.exe PID 4080 wrote to memory of 2824 4080 WaterMark.exe svchost.exe PID 4080 wrote to memory of 2824 4080 WaterMark.exe svchost.exe PID 4080 wrote to memory of 2824 4080 WaterMark.exe svchost.exe PID 4080 wrote to memory of 2824 4080 WaterMark.exe svchost.exe PID 4080 wrote to memory of 2824 4080 WaterMark.exe svchost.exe PID 4080 wrote to memory of 2824 4080 WaterMark.exe svchost.exe PID 4080 wrote to memory of 2824 4080 WaterMark.exe svchost.exe PID 4080 wrote to memory of 2824 4080 WaterMark.exe svchost.exe PID 4080 wrote to memory of 2068 4080 WaterMark.exe iexplore.exe PID 4080 wrote to memory of 2068 4080 WaterMark.exe iexplore.exe PID 4080 wrote to memory of 3060 4080 WaterMark.exe iexplore.exe PID 4080 wrote to memory of 3060 4080 WaterMark.exe iexplore.exe PID 2068 wrote to memory of 4328 2068 iexplore.exe IEXPLORE.EXE PID 2068 wrote to memory of 4328 2068 iexplore.exe IEXPLORE.EXE PID 2068 wrote to memory of 4328 2068 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\192e139015c44fbc67b75a89abe99a86_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 2045⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2824 -ip 28241⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5fa34ecb8815a2d98849888cb1cdbf38b
SHA184fd0e04586009efb3683c98da8d9aa41487cd42
SHA2565077a54924f80491a74ed78bbd73ff7bf85a27caddb80ceaa9ccb86f8b9a11be
SHA512ccfdb76ccedd0076601e17272d346229e2b9c0dd884c09bb7701b32c5dc177da8a91bb539ce751297d8ea44716fc497e8a337a9499c93a474ba85915f28f1053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD55ae9d7c2e08755fd15787ea2ee9d852d
SHA1f02114ad7baee3ef752adb26ef36f31ea56d2f46
SHA2569f04d32d6182416a367bbda7323146189b0f20538f28dc4f009cdb1b16066dbc
SHA5126e136fb9c45fd7d26e30cab9d6ed15d20eee5d86cd2828889df64a995ada8a2f4213e29abfcaa2dc73a1666ff1e9cf554d88d9316d160ed11285fd2ef4741a36
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\192e139015c44fbc67b75a89abe99a86_JaffaCakes118mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/316-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/316-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/316-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/316-6-0x0000000000401000-0x0000000000402000-memory.dmpFilesize
4KB
-
memory/316-5-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/316-24-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/316-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/316-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/316-9-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/316-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1500-7-0x0000000000C40000-0x0000000000C6C000-memory.dmpFilesize
176KB
-
memory/1500-0-0x0000000000C40000-0x0000000000C6C000-memory.dmpFilesize
176KB
-
memory/2824-34-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/2824-33-0x0000000000F30000-0x0000000000F31000-memory.dmpFilesize
4KB
-
memory/4080-32-0x0000000077302000-0x0000000077303000-memory.dmpFilesize
4KB
-
memory/4080-31-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4080-36-0x0000000077302000-0x0000000077303000-memory.dmpFilesize
4KB
-
memory/4080-35-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/4080-37-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4080-25-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4080-28-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4080-29-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB