4e87a0794bf73d06ac1ce4a37e33eb832ff4c89fb9e4266490c7cef9229d27a7

Analysis

max time kernel
129s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 08:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe
Size

768KB
MD5

11cf5ca49a6c354eb005fb24bdf6b1f0
SHA1

c37b9b9fea73c95de363e8746ff305f4b23f0c28
SHA256

4e87a0794bf73d06ac1ce4a37e33eb832ff4c89fb9e4266490c7cef9229d27a7
SHA512

ac91cb1e00db5eab4dd2253f745703d95ea4fe086c4289da62088f40ea727e4b54205d230b4282d38df006c3aebb2522058e2737c90d426abf900368c9c6dbba
SSDEEP

6144:jLPkIupKPUWqUzHwlyLqZucfo/4dQSP8AEcmqRYn/nCrK8cI1WaWQ0vOKO5DBHQp:3kXoDOUAuao/Kl9a9bQ+ZE1Qyu9

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	Kip1.exe

Executes dropped EXE 4 IoCs

pid	Process
3284	Kip1.exe
1216	Kip1.exe
3016	Kip1.exe
1632	Kip1.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3284 set thread context of 1216	3284	Kip1.exe	101
PID 3016 set thread context of 1632	3016	Kip1.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2256	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3284	timeout.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60707fe6f99dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{221863DB-09ED-11EF-9107-769225464011} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d44fe6f99dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31104505"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fa1cacc1b5bc1b46b672921b3ff78086000000000200000000001066000000010000200000000ca610c458a7f2abc40bae0cb7fccc12c1025d6be5d19c3e816101614a55acf1000000000e800000000200002000000096d183ac11f1940d5b135cec2735980c3980ae356d1c7d51af797f57af3a0ea8200000000f51da8ca6ea214c937a15ce3263dbc3731c01bf6634bfeb0e747e446ce77a3e4000000084674215c22916e83c7487b3844246244526d61f9aecfb54170009c5f20741e6d0dca66ab364fa8aa9a0b2ec6bd55b610be99e1eff082aa2fb276a344421e3ef	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4133991859"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4133991859"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fa1cacc1b5bc1b46b672921b3ff7808600000000020000000000106600000001000020000000f0677a861ce0b8ba65ac101c0e7c30a633f92dc3731d828b6e8c80dd06ad4ca1000000000e80000000020000200000008b1db1e74faaea61ebb0688fd55c3ede579398b0d479940e785ece3b6c56e5a72000000092e6ef3b987c7f424150bef4e139ff7402fdb30e62254993147c2a847ca332de4000000036ba9d6694141f1da866a989c244a2cbcc03cfacb0f29d67c4451f88c26e4634d9df2dc5b65bcf247912123a8d557251603f91dbee971d636cccdcb366bf726e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31104505"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306a2ee6f99dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fa1cacc1b5bc1b46b672921b3ff7808600000000020000000000106600000001000020000000d6d203b5ae6b1ee54746d9b2405200ad3006b3d23b8f1c8bd8a938a4830a84b4000000000e8000000002000020000000c433f9a8ef1461d3e5f17dba6e238699c1bbbd3d46d50d05ad01b18729e27b93200000001912523af06d83dbf3cbd5969ada63a931a674520dc239034abb2b57489d74d240000000d45431ba25bfe882c653bb9ae18d2472fd749372dd803a8daa527189b093e447fd8eaede3e69d5f45f8be12d63d0d173397b67fd92ae7623bb79ed462861c6a8	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1216	Kip1.exe
1216	Kip1.exe
1632	Kip1.exe
1632	Kip1.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe
3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe
3284	Kip1.exe
3284	Kip1.exe
3964	iexplore.exe
3016	Kip1.exe
3016	Kip1.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe
3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe
3284	Kip1.exe
3284	Kip1.exe
3016	Kip1.exe
3016	Kip1.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe
3284	Kip1.exe
3964	iexplore.exe
3964	iexplore.exe
4548	IEXPLORE.EXE
4548	IEXPLORE.EXE
3016	Kip1.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2256	3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe	94
PID 3996 wrote to memory of 2256	3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe	94
PID 3996 wrote to memory of 2256	3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe	94
PID 3996 wrote to memory of 3116	3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe	98
PID 3996 wrote to memory of 3116	3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe	98
PID 3996 wrote to memory of 3116	3996	11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe	98
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3284 wrote to memory of 1216	3284	Kip1.exe	101
PID 3964 wrote to memory of 4548	3964	iexplore.exe	104
PID 3964 wrote to memory of 4548	3964	iexplore.exe	104
PID 3964 wrote to memory of 4548	3964	iexplore.exe	104
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 3016 wrote to memory of 1632	3016	Kip1.exe	106
PID 1632 wrote to memory of 2108	1632	Kip1.exe	107
PID 1632 wrote to memory of 2108	1632	Kip1.exe	107
PID 1632 wrote to memory of 2108	1632	Kip1.exe	107
PID 2108 wrote to memory of 3284	2108	cmd.exe	109
PID 2108 wrote to memory of 3284	2108	cmd.exe	109
PID 2108 wrote to memory of 3284	2108	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11cf5ca49a6c354eb005fb24bdf6b1f0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN "Eburin" /TR "\"C:\ProgramData\Kip1.exe\""
  2⤵
  - Creates scheduled task(s)
  PID:2256
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /run /tn "Eburin"
  2⤵
  PID:3116

C:\ProgramData\Kip1.exe
C:\ProgramData\Kip1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284
- C:\ProgramData\Kip1.exe
  C:\ProgramData\Kip1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:1252

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3964 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4548

C:\ProgramData\Kip1.exe
C:\ProgramData\Kip1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\ProgramData\Kip1.exe
  C:\ProgramData\Kip1.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\ProgramData\Kip1.exe" >> NUL
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Kip1.exe

Filesize
768KB

MD5
b211348f8784ea450e1364c053046a6c

SHA1
70df9df1ffe20e7eac54e424c2e76242696904d2

SHA256
ca11b8ffbc782df697f34a26df930970b1ced2efbf89a34c506ae80a1cdc43bf

SHA512
b69d29cb50fbc3872a0e372c28747d56c94c094af7fe80168dfa48656e309aba32a7e9c7f26df6b5d2f2420592e6b079fc3df517298f2456e40aec2d8e36573a

Download Submit
C:\Users\Admin\AppData\Local\Temp\225208468

Filesize
417KB

MD5
33573120ecf4a9ccaa2fe97832ee6fc7

SHA1
285b502f61cecac5d2f8ad3275ae41ff7d768eee

SHA256
5a468668342be83ee0f364d4f5d426ac5a4dcf55446ef743950e4613a3174290

SHA512
1d6166b18ed1ceb19e7cff72313231c64ef1e856de6ae2c41834c477ed145fcf64bb97ed9236324aaa1c4a0e4cfa0013f79cd1008855005c6584389b1be4f715

Download Submit
C:\Users\Admin\AppData\Local\Temp\768999484

Filesize
114KB

MD5
4808263efeec1019f450544f9b314ef3

SHA1
8864bd10d2f34adbe3c6abfb7cad1c900d5d2600

SHA256
37cf3ea98c38978a62b53f6162e17ec5c617a4d86a9dcdb2da19f9977ec584a9

SHA512
5d607c7b8db405066c5d9d354f18016db71b7d93f25b58d65844fdb94b3c635734ffb4c8936c4a8660211afef025e39b350180105f049eb79d9bb25315f5ec3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7949157282

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
memory/1216-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1216-13-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1216-70-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1216-12-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1216-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1632-79-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1632-80-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1632-150-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3284-153-0x0000000077871000-0x0000000077991000-memory.dmp

Filesize
1.1MB

Download
memory/3996-2-0x0000000077871000-0x0000000077991000-memory.dmp

Filesize
1.1MB

Download