e7a846c73f9db4d5569b30148b80464e671f7c2476ea0ff1ecef523efaeb7a75

Analysis

max time kernel
150s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f615b6014fb251ccd489f7e6105dacb1_JaffaCakes118.exe
Size

30KB
MD5

f615b6014fb251ccd489f7e6105dacb1
SHA1

3af8d5244a15a2404bccc185d70f66b7fa52b887
SHA256

e7a846c73f9db4d5569b30148b80464e671f7c2476ea0ff1ecef523efaeb7a75
SHA512

774591b48672ae64a253e81d31211eedb3358b1bf1c431a4ab10027c4067632433c3aa56528788fe422301a3bbc111110849f750a6a17133fbadae7a4c696249
SSDEEP

768:/JYxvQCzbZLlxEEr2bc765DmODZZPZB52jN:/JKbZpeE25DmQm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2940-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2940-7-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000f6e9888927d2734624f79db744b306acc437da2c63f65efbc1ec02ea0b02a0c3000000000e8000000002000020000000098cdf6913319a57868413cdaaf290909a0a94ad7d2ef21eee78ab2147d5de4f20000000f4ccfe9a887cbc864223f41fc3680471d00d28273e04e14d12caa6e8dd09206440000000f5686c3ddebd927139a5ed702adb962c65ca65156e0753afd63082967c40cd3d850a8166ca46d1de7b33dced4de0dfef579fe25733d7a765e25b5f3f676166fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000002668ff80cde52ee39d00165fc2cbd06cca4e175551c684a47fba03699cf64311000000000e8000000002000020000000ee4263d9fe084a58118e99ddac2e2016db1a9138675ad9dfa322541f3dc5575490000000012f355d1c1c6792d4c67115e06c279a614247042158d64d4c38a39bbc53e1e23f041472b175e35e5d9fa27b5a46f75bcfef516e0cf3ddc620a89cccb7db62d1e145ebfed0fa815cd3e05d92c7f58213d912e89ab6ee967bd753879974b36eda1cb749d8759a84b6366f6c1ad85ab3515bd7c6015e8e75ffdd3f27986b2ef0b0de9b59b43e14134e68b8c955eec35a9a400000009638efb0e46d4e651d2f31b57c2fd951b095eb5166a1d74118734aa8999faab66c750b837401ea429f4481b78152c9a98ccaf92d74e02efdbc1ad5ec62497ba1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3025907cdb90da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419529364"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4BFA671-FCCE-11EE-B1A6-DE62917EBCA6} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1040	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2940	f615b6014fb251ccd489f7e6105dacb1_JaffaCakes118.exe
1040	iexplore.exe
1040	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1040	2940	f615b6014fb251ccd489f7e6105dacb1_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1040	2940	f615b6014fb251ccd489f7e6105dacb1_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1040	2940	f615b6014fb251ccd489f7e6105dacb1_JaffaCakes118.exe	28
PID 2940 wrote to memory of 1040	2940	f615b6014fb251ccd489f7e6105dacb1_JaffaCakes118.exe	28
PID 1040 wrote to memory of 2708	1040	iexplore.exe	30
PID 1040 wrote to memory of 2708	1040	iexplore.exe	30
PID 1040 wrote to memory of 2708	1040	iexplore.exe	30
PID 1040 wrote to memory of 2708	1040	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\f615b6014fb251ccd489f7e6105dacb1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f615b6014fb251ccd489f7e6105dacb1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81d0b7671bef2084b8b7ffa7cbad3090

SHA1
2855bc1b4a753ff61c332ff16c2c2f8672afe857

SHA256
a2cfdca394802dc6782515d64b436fc1f0c57ee8efec16af8994bb187cd486db

SHA512
463173de844a387051641ad5314d7ff36f0fd4a5372e7bb1fad4dc78bd07c0ebc809085ddc81b5080fa4db1a358d53946e45ea590df2f262195e29520a575c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dd757eeec5a7299bb7eb70838f6828a

SHA1
6d9ca179a568dc9f2ab5b5f2ca308dc35688fcf8

SHA256
1e3f10af4a016ca2fda6b99f535408c2a6891ac5b5381c45f67ac31ebd064f5f

SHA512
9554edd973098e4b424bae8e88a164b76be6f382126f2e9dc5244d05f03afe645ea75bf9d838cf2f5f7752c1f0a4c65b2ec60b05b1e8a33a1b2297c5b404c56c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5feb90f2d4d17ca01afca7cc48b62a76

SHA1
a0dc1f72feeb06c239448dec38192f7aea96a2e7

SHA256
3a5bc082c6549fa04e6472a89af2d523a96c3419fa030de75b25875ebc479fa4

SHA512
b28593345db4b0cc89099d215e206e430c5390e6a9a8b105b88bd3403f483eb5c74885d30703c46060e191d8effaab3cd6db55fd00e5412d6f4bcc42c4d3b6d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cffe677ff1347772729c275341f1cdd6

SHA1
26e069925eadf05d5d23c1e1ac83541262672b49

SHA256
7d720f8252fc59fa00700ed02cd41db1a90c3498705ba45250ae500f4ae0c81a

SHA512
52fafd3341a169dff14e8f5ee43a08ae4f03b2c27022db4aa33c44d8f71bec35054b9f26d7396edf7558f72c76f6e2b191b85f22af660d12cc8133ea49960bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04fe7512412528469b9fbe5b39bddd1c

SHA1
22dfba404dd86635d761ef46a121bacdd4419748

SHA256
a87c15569c3821f7b9ec361c81e61b6da7e08b2cd3804c3c222ed070b8bcad8f

SHA512
61f4bf640aa36d47a434b8cee4785b17a144c64d2fb6fc2455b9428f015d7fd039cbd8f5030c6e13421c40453b54c4f68a17304b593ca5f97e125616cbf351d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f64043a2539323da75b033e5f980e54a

SHA1
e92071a1795d50ff0ad2182aba6f0c029d43f1d5

SHA256
ba11c6e1e7f0daced2acd0af7d4d94125d8363703542a57ed4de34685dc910f2

SHA512
d776797977837a0df36c283adbb9b2b24d7222b1e5a683b0d15b0f5a405778ae5fb9d0da79b1e807a0303c7c3dac088d07804d207984ddc655fcecf1d0595c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ad1c7a58cb63da4458d27e544adec52

SHA1
857bd4cacc734d8b0578d72af8427901d472d0b4

SHA256
d9d88b49f1576dc251815305ed12e95a46d244a9b2a2fdb6a689f7ad30ee7251

SHA512
30a949d63abe53ac457cbbcec34011fc683182b852c4ea108eabe8329239f4e657ff7052f654ce37eeec03d0a691784c117e91b3b732e9a00fc1e0dbb1238b6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cff704f99596ee03584d06a04debfa50

SHA1
0697cb9eb405cb81a115ad4da686c61f1a393bcc

SHA256
226022b6de4d3cd466f61ead91d62669d79beabcf4be3c766393b3e59fe38d28

SHA512
45071ec82287959bbce6163f5da23c6b559274c377758dcca49af7c8e7afb8f91399b4f16868544635c2b2864869dbf71f1d2434df2eb689a97faef2be7702d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4acf6e48e7b444810342c25cbd74f011

SHA1
8b5f3027a2ca7b0bc0d9b1443e99213d8c58dbf2

SHA256
4c63ef796db2ba09712c5bcda7293eeaf4dcd274ecfc2f551bb3626d898c5973

SHA512
2770fc5bc2059f02e82b4530e7f6f5f7ad54dff67590971e9eaa0c145ce2f837a967bec0732428a08ca1a6d5af318c970af7c15a01846dac83d55b924397c507

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar914F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/2940-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2940-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download