996e6000cebbcd231bb0ffb7c9dbe528c556d9e0081d38ecae0a6a10d432ce7d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
Size

3.2MB
MD5

1a2bedd15436c6bf168ca435bfc7e9fa
SHA1

10b20ee762c52bc68f010d57ea14262430a6313e
SHA256

996e6000cebbcd231bb0ffb7c9dbe528c556d9e0081d38ecae0a6a10d432ce7d
SHA512

fab563f86a9151550d7d0344e7f98e23713c530f76f8f3cf769d1a2727f1de6727449e83533271645eb8a2b6152abc9fd82400bfa9211a0de98ab75e7ccfe669
SSDEEP

98304:KAXTR4Iqr84H0piOVlOkEECzZWygXjuVQm5c2kTekBez:tOxVH1OHOkEvXMSVd5cV6Oez

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe

pid process

2924 1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
2924 1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main 1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe

pid process

2924 1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe

pid process

2924 1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
2924 1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe

pid	process
2924	1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
2924	1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe

pid	process
2924	1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe

pid	process
2924	1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
2924	1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2924

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
ef3b57717b90bdfa2b58efc64f1eb96e

SHA1
0503859bdc699a9702d4fe1b31567220ee4866f9

SHA256
5f1e532c24c3ac0f3c573e322742337131c74c8bb8cc7b8f10acffc92503065c

SHA512
42ff56a18d2f8403111900bd71af86aff5615d4c3706136c4f1b0883eb46966f6bd6a8ceaed4f4f126004aeb6924cdf5ef76e3de0838823964b4668980115dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2350.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1A74.tmp\ioSpecial.ini
Filesize
657B

MD5
366ae3fa0827c998124c255693b9f4e9

SHA1
8de37b84d4f9a2d3cf8e437e79fc782f53a2ac4a

SHA256
78a87e09d3d933cb3cfd2cde1b3ba8a1f47183ae3db709d3fc0b6e8475004c58

SHA512
b8c5e0e29ec9570c8268345fce0fc50ab28b3df46acba742b7681e618f885166a5924c3ea34043c0d1d55dd7bd0923d2528b71afa6ca991cf331f70599754332

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1A74.tmp\InstallOptions.dll
Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1A74.tmp\WebCtrl.dll
Filesize
5KB

MD5
418a34a689d5f9bb85fc951168749edb

SHA1
0b75ce26883e12944abdbb67c143000fd0905d6b

SHA256
915322078d1f8eb278250f446c1960e1555ffa0f8dcd048a48ed32fe7f5a5b3f

SHA512
9aabb74cfd37cbda4718077ba76c7906e0f3ab5949e99f9d800fb1952757a60cabe29413f054f62e2887ff57aeb9d355532fd1662ebf3a523a500b20fe702b90

Download Submit