fbe584e95bf06af62e697cc8d74da414be2181269ade210b2e597f7c103becb0

Analysis

max time kernel
113s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 16:09

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

edd282afc0eca2c5192a6e3c90b8dd9e_JaffaCakes118.exe
Size

20.5MB
MD5

edd282afc0eca2c5192a6e3c90b8dd9e
SHA1

6677a198e88b424cbdbd4774cf24776d7d7a6128
SHA256

fbe584e95bf06af62e697cc8d74da414be2181269ade210b2e597f7c103becb0
SHA512

1805bfcb7b5b6b018f56269923db9ad3204a96ec1849917d286d778e37388058d81c08d10d89fc8a38862335b0046ce95f691abf4fb8b66b2eafd34eff047333
SSDEEP

49152:EQFRHrmQG+yrV2F0rV2ErmQG+yrV2F0rV2FF0rV2ErmQG+yrV2F0rV2V2ErmQG+5:EcKmCrGCrsrZt

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2532	h.exe

Loads dropped DLL 2 IoCs

pid	Process
2812	edd282afc0eca2c5192a6e3c90b8dd9e_JaffaCakes118.exe
2812	edd282afc0eca2c5192a6e3c90b8dd9e_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	h.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	h.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2532	h.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2532	h.exe
2532	h.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2532	2812	edd282afc0eca2c5192a6e3c90b8dd9e_JaffaCakes118.exe	28
PID 2812 wrote to memory of 2532	2812	edd282afc0eca2c5192a6e3c90b8dd9e_JaffaCakes118.exe	28
PID 2812 wrote to memory of 2532	2812	edd282afc0eca2c5192a6e3c90b8dd9e_JaffaCakes118.exe	28
PID 2812 wrote to memory of 2532	2812	edd282afc0eca2c5192a6e3c90b8dd9e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\edd282afc0eca2c5192a6e3c90b8dd9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edd282afc0eca2c5192a6e3c90b8dd9e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Temp\h.exe
  C:\Users\Admin\AppData\Local\Temp\h.exe -run C:\Users\Admin\AppData\Local\Temp\edd282afc0eca2c5192a6e3c90b8dd9e_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\h.exe

Filesize
21.9MB

MD5
51aa44ed3ef125558c54008486d09b87

SHA1
b7385834d1dbb84ba0fd96e83a7b9633e89ccbe3

SHA256
ebd7845548cb9449972674ce8b2a3bcc3ce610ac02668b3d15e5b5e90b76fc69

SHA512
a9107c476cfd88fb1a1cd4f005c4980b773aff0d1ab0a53dd4e231adfd5ca36c4181d024cc23981753266d8cdb0ad246eba0ea860df0416a1f512e4f4a7f0e2a

Download Submit
memory/2532-54-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/2532-55-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2532-56-0x0000000002B50000-0x0000000002B51000-memory.dmp

Filesize
4KB

Download
memory/2532-66-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2812-11-0x0000000002B00000-0x0000000002B02000-memory.dmp

Filesize
8KB

Download
memory/2812-15-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2812-2-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2812-23-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/2812-22-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2812-24-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/2812-21-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2812-20-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/2812-19-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

Filesize
4KB

Download
memory/2812-25-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/2812-27-0x0000000002060000-0x0000000002061000-memory.dmp

Filesize
4KB

Download
memory/2812-26-0x0000000002080000-0x0000000002081000-memory.dmp

Filesize
4KB

Download
memory/2812-18-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/2812-17-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2812-16-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2812-7-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2812-14-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2812-13-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2812-12-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2812-0-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2812-10-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2812-9-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/2812-1-0x0000000000280000-0x00000000002D0000-memory.dmp

Filesize
320KB

Download
memory/2812-8-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2812-46-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-5-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2812-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2812-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2812-29-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Filesize
24KB

Download
memory/2812-30-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-32-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-31-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-33-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-35-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-36-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-34-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-37-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-38-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-6-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2812-50-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2812-51-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-53-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-52-0x0000000000280000-0x00000000002D0000-memory.dmp

Filesize
320KB

Download
memory/2812-48-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-41-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2812-68-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download