Analysis
-
max time kernel
141s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 08:54
Behavioral task
behavioral1
Sample
1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe
-
Size
936KB
-
MD5
1986242734173a6d7faeeae5165e28b5
-
SHA1
0091f9bc0cfd99e5cb347c2ebbd4b53dad041b0f
-
SHA256
583d9ccdc1024490949aed20d307505b17a06d6c54cda4dcf638eee39cee98c7
-
SHA512
0ea0dfb4547af4bb49234d0c158c0e9c39a7e50c6e07ff87d4f4ed58693d72b801c7cb0a754a624eb53b1120d2087d49d0dd9048ac8810f3cd2d6acc22f5223c
-
SSDEEP
24576:vt1/nvW3lo7nyBUGtPZyR3xHq/SRhlGw:vt1G1o7wPZyDq/SRrG
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/3108-0-0x0000000000400000-0x0000000000705000-memory.dmp vmprotect behavioral2/memory/3108-2-0x0000000000400000-0x0000000000705000-memory.dmp vmprotect behavioral2/memory/3108-80-0x0000000000400000-0x0000000000705000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115576" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fea8ac7b1719d7438b2b1567698ec946000000000200000000001066000000010000200000000f6e9d55907d17eb7715696d32f1dd61c9bf1b1cdb5db054abb7779a24afcf9d000000000e8000000002000020000000f7a4592c0edfd4306407990a349f4107dc967def01a994ac09117ef6b6863c9d20000000bf014855665e1c93d298496111e530ff87fad28c9c8d5c7e6daedebd9e204903400000002c5b014676cf18c2dc03082062af7aafb7d5bc8c31167e1ce4f919c18bc45cb0fcea0dc855883fc4555288ec1260d466cda53b69ca5c2af8e732680db8a279e3 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3856107226" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01248e838c9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115576" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3803607057" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0E0EE713-352C-11EF-B9F7-6257B05D87B4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3803607057" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805162e838c9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426329860" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115576" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fea8ac7b1719d7438b2b1567698ec946000000000200000000001066000000010000200000002904df9a6dfcd65ce28cd5b70a4b4152bdaf906a4bd953c2705da2c1732a75d0000000000e8000000002000020000000daf8d8e0cd3fee427c300c4e2d1a86720f98a90518c49af5aee41250e6fb67f720000000f8acf4ab6d3d28815f369bfb69a2a0870bbfc7fec569a675552ae33c1d0711e34000000050ed63fec4abc6c7f4f790c6dbf5948290a1a48eb33ceb39d8ade10e99634fb03e4eba16a0e6ac2665e024965f79a4e6d0a6d1011eaf46b3012f9d42ff484627 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2700 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exeiexplore.exeIEXPLORE.EXEpid process 3108 1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe 3108 1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe 3108 1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe 3108 1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe 2700 iexplore.exe 2700 iexplore.exe 3488 IEXPLORE.EXE 3488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exeiexplore.exedescription pid process target process PID 3108 wrote to memory of 2700 3108 1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe iexplore.exe PID 3108 wrote to memory of 2700 3108 1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe iexplore.exe PID 2700 wrote to memory of 3488 2700 iexplore.exe IEXPLORE.EXE PID 2700 wrote to memory of 3488 2700 iexplore.exe IEXPLORE.EXE PID 2700 wrote to memory of 3488 2700 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1986242734173a6d7faeeae5165e28b5_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" www.dnfann.com2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5fa34ecb8815a2d98849888cb1cdbf38b
SHA184fd0e04586009efb3683c98da8d9aa41487cd42
SHA2565077a54924f80491a74ed78bbd73ff7bf85a27caddb80ceaa9ccb86f8b9a11be
SHA512ccfdb76ccedd0076601e17272d346229e2b9c0dd884c09bb7701b32c5dc177da8a91bb539ce751297d8ea44716fc497e8a337a9499c93a474ba85915f28f1053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD51f68ccc1e206567017fb645498758797
SHA1be6b6d0c2566f07cc7c5a73d18f2a14869a7ebaf
SHA2567a746e4661767db55a9194ce12b02aad1f6299108ef8e16cf6f8c757eccd7f65
SHA512cd642d16c5e519579e76025e82f82f418a57f40e2da9b56d3ec94b008921bb0029b8d8e542174dc8d03ba07e34ccd01768874a48603f47e71935ed5989121f9e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\script[1].jsFilesize
96KB
MD5bfc517188e31c284e6f920185ef9581f
SHA1dc44e4b0baaa94841eaf301191236605e05aac26
SHA2562cb9e929560926259750c4d840710fbf0a7d2c8da9a9a886ee478bc362829e7e
SHA512d3f98cf4d1b282d8d673320910acf320de861f363f522dcb1ff7720575c0d80ccd8eda85acbb5ec9867f98010ab9c0e07f2a3dc08d5f0ad0ff1a4f3f82f048cf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
memory/3108-0-0x0000000000400000-0x0000000000705000-memory.dmpFilesize
3.0MB
-
memory/3108-1-0x000000000067A000-0x000000000067C000-memory.dmpFilesize
8KB
-
memory/3108-2-0x0000000000400000-0x0000000000705000-memory.dmpFilesize
3.0MB
-
memory/3108-80-0x0000000000400000-0x0000000000705000-memory.dmpFilesize
3.0MB