Overview

overview

7

Static

static

1

69abf01bac...18.exe

windows7-x64

6

69abf01bac...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    130s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 04:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69abf01bac12c635853b66f08b90de04_JaffaCakes118.exe

  • Size

    95KB

  • MD5

    69abf01bac12c635853b66f08b90de04

  • SHA1

    64aabc8f0039e356429a21a9a0810f38a4bcee36

  • SHA256

    14fe3c6be7ec89c653143c7f03907e5cb1713ddcf33da20cacee267b27648415

  • SHA512

    4106f858405658d4b0de899d5b68f09520089de9295be7c49207bcafc4ebe587668f1587283793c7313c2de95170e045cb859de2c24f60471a07fcd840df8d0b

  • SSDEEP

    1536:HCPkWjh/+90uvEfG1Wjh/+90uvEfGbWjh/+90uvEfGYiZ4B27++5/G+Vriq:HCPkWjh290uvEfG1Wjh290uvEfGbWjhI

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 49 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69abf01bac12c635853b66f08b90de04_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\69abf01bac12c635853b66f08b90de04_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://search.myemailxp.com?uid=89eab332-6a1f-45a6-ac2b-3396e3281d9e&uc=20150718&source=pd_gs_email_gmail_test&i_id=Email_xp_0.0.0.5&page=newtab
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5044 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    01409a92b179c99711ea8c28d307d0c4

    SHA1

    a9cc2b0c5727e2af14819f3908c4693f8e891392

    SHA256

    3034962a4c308ef5e66a2de7faf1ed2439b7e59086a8c07ad59ce3669b8ee01c

    SHA512

    8e86173a54d253f3e05443c603222b9018d63a3fb8e3a26b2b5602c083c07b117d5c53ede08056b6aa4503380562444c6704de32b2cce76f146478616b7278c9

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    404B

    MD5

    67b48ce5411a6022615af55d8a858d5a

    SHA1

    6a80ccd28da6f5d7e1cc04c9d5cd6a20fdc66220

    SHA256

    0096a4da53a63ef0c680ed45b72710a09292047cd1699655681fa21e3181c184

    SHA512

    fdd9bb1f99a9b3c939c43f8ae144ea4c07c1f3d2e5337e13bcf0222f1390bb74e01e63481d0124e0bb027d9897a16f0f02d0561a36f55a2d3de2a3a7278fccc5

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6SQF6WJH\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit
  • memory/2204-0-0x00007FF91BE25000-0x00007FF91BE26000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2204-1-0x00007FF91BB70000-0x00007FF91C511000-memory.dmp
    Filesize

    9.6MB

    Download
  • memory/2204-14-0x00007FF91BB70000-0x00007FF91C511000-memory.dmp
    Filesize

    9.6MB

    Download