42c682bb28f8888229acc4d4c3817f6ece6bd00b3375972830adefb90bd5dd90

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe
Size

989KB
MD5

30454406da2164d562b54bfd26432f7b
SHA1

f23c16975a9aa2560d3fbc189414c86696bfb409
SHA256

42c682bb28f8888229acc4d4c3817f6ece6bd00b3375972830adefb90bd5dd90
SHA512

66ecf22c36607623ee216f2a41be4ed5ba10a69e1b179c4e70d6ddeb8a0ad67b66afba2ab4a6102c07572c6860500c7d61ae325a8b839eb0d1ffce5ce13e1600
SSDEEP

24576:sx4Mi4+EaWyZDAbKh6tBoJU0DuF4jovaVGMwxJE/qlpzwuO:QcEaWjrjiA4jova8Mb/qlpzwuO

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\IESettingSync	30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3012	30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe
3012	30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe
3012	30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe
3012	30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe
3012	30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30454406da2164d562b54bfd26432f7b_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\30454406da2164d562b54bfd26432f7b_JaffaCakes118.data

Filesize
988B

MD5
8735817bdbd136c067c6fdfc116f0086

SHA1
75c9f5bf62bee6cfe630fac7bf72b776d4e8cd9c

SHA256
03b338efc186a9795e9da9dffc1e601bd7cb1b077fafa0a420f0b753fcc326fe

SHA512
03fdb0cdd366e60370c001a627026ddc281766867738fb1b698e362308564b75f476ff6a592308da8bff48667c0b6b6f7f11f88ab8027a00800bd5d6680b3005

Download Submit
memory/3012-0-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download