542208b64cbce25252292e49298676cc4206905eb8ac3f4b12c7d6c1eb9c6fe8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f714039d6218d62c29f36d420caee373_JaffaCakes118.exe
Size

2.0MB
MD5

f714039d6218d62c29f36d420caee373
SHA1

8169dc7208dd5da9483f88eb08f32033ac5e2bff
SHA256

542208b64cbce25252292e49298676cc4206905eb8ac3f4b12c7d6c1eb9c6fe8
SHA512

7027ec88c652d0b4cda113338ba1e7a8dbca80edc007cde5ce916b30947a991bd74c966dfc1017d539d670f37595f862365a4b69aaa2c0300bb70f4f3eaaaa00
SSDEEP

24576:+7QFRUm/rCYAj8pXU+Cz/rV1K/CYAj8pXU+Cz/rV1H:EQFRHrmQG+yrV1K/mQG+yrV1H

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2568	xtxa.exe

Loads dropped DLL 2 IoCs

pid	Process
1728	f714039d6218d62c29f36d420caee373_JaffaCakes118.exe
1728	f714039d6218d62c29f36d420caee373_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	xtxa.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	xtxa.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2568	xtxa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2568	xtxa.exe
2568	xtxa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2568	1728	f714039d6218d62c29f36d420caee373_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2568	1728	f714039d6218d62c29f36d420caee373_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2568	1728	f714039d6218d62c29f36d420caee373_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2568	1728	f714039d6218d62c29f36d420caee373_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f714039d6218d62c29f36d420caee373_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f714039d6218d62c29f36d420caee373_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\xtxa.exe
  C:\Users\Admin\AppData\Local\Temp\xtxa.exe -run C:\Users\Admin\AppData\Local\Temp\f714039d6218d62c29f36d420caee373_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xtxa.exe

Filesize
2.9MB

MD5
5c6202dbcf67719745b524f5d978a0dc

SHA1
6a10962fc44dcc89366d2fe5949c4a10fd3edb11

SHA256
5b073a2004dcd76229aa44df04ebde31a4de4a9ef384b4cda5cc2f96a9fc842b

SHA512
da90c25d498defd1ed874fdf3d496f38c4481ae9a0fef5812bde73af036b02fab89aaa59f4a7ac5608b5b53c5dc00378f4c62f47d0012acebefee347edefe967

Download Submit
memory/1728-0-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/1728-1-0x00000000002A0000-0x00000000002F0000-memory.dmp

Filesize
320KB

Download
memory/1728-11-0x0000000002B00000-0x0000000002B02000-memory.dmp

Filesize
8KB

Download
memory/1728-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1728-9-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/1728-8-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1728-7-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1728-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1728-5-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1728-4-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1728-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1728-2-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1728-27-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/1728-26-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/1728-25-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/1728-24-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/1728-23-0x0000000002040000-0x0000000002041000-memory.dmp

Filesize
4KB

Download
memory/1728-22-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/1728-21-0x0000000002020000-0x0000000002021000-memory.dmp

Filesize
4KB

Download
memory/1728-20-0x0000000002060000-0x0000000002061000-memory.dmp

Filesize
4KB

Download
memory/1728-19-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/1728-18-0x0000000001F80000-0x0000000001F81000-memory.dmp

Filesize
4KB

Download
memory/1728-17-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1728-16-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/1728-15-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1728-14-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/1728-13-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/1728-12-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/1728-28-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Filesize
24KB

Download
memory/1728-30-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-31-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-32-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-38-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-41-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-51-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-52-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-50-0x00000000002A0000-0x00000000002F0000-memory.dmp

Filesize
320KB

Download
memory/1728-48-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/1728-40-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-39-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-37-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-36-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-35-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-34-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1728-33-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2568-54-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2568-55-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2568-56-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2568-57-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/2568-65-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/2568-64-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2568-63-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2568-62-0x0000000002B40000-0x0000000002B41000-memory.dmp

Filesize
4KB

Download
memory/2568-61-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2568-60-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2568-59-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/2568-58-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2568-66-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2568-67-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2568-68-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2568-69-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2568-70-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2568-71-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2568-72-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/2568-73-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download