40650ecb04452369c3d6157b207d24d56498cd3fc64a68600f138c1b32fd9ea8

Analysis

max time kernel
141s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 05:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69e831dc3d29a7b5e978336e9bd162ee_JaffaCakes118.exe
Size

6.4MB
MD5

69e831dc3d29a7b5e978336e9bd162ee
SHA1

40fcfee62420d295b113aeffe762d73f5167d247
SHA256

40650ecb04452369c3d6157b207d24d56498cd3fc64a68600f138c1b32fd9ea8
SHA512

d52fe818bdd9a55830690aae0fc3b9e0cdbb49d509578a19c059d246880ddbef5f4e56c89ceab91c683ba4e2243c78ac6458ceab7c0fe41bc6b92a695d8a87f8
SSDEEP

98304:hia4SWONrzB1pUqG8apgW5vL/IIdpm3eC5TV15gjEVgW2IZ:PWOzRUqsgcwIdpM7Vo9W2Q

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	69e831dc3d29a7b5e978336e9bd162ee_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	69e831dc3d29a7b5e978336e9bd162ee_JaffaCakes118.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PhishingFilter	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 1033b280d3acda01	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD8FA651-18C6-11EF-BC3A-56D57A935C49} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10128a92d3acda01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000030ab4a41cf160248ae1764f9bf9519b9000000000200000000001066000000010000200000002348447c66f8c0374645b7c541d7861ec1cff2dbbdb486cce7c100386a67a1ad000000000e8000000002000020000000f22e7fb0379a9cffa1a5ade798fa638d688d9b1b95591f0147cee1009302ee0d20000000dd98fffb7844311c28670380a082ddf8f88c7b4e9e57fe12c87ea277d9e72fd2400000004f825aa4ae084d78459901ede3851e39c2bd0499df009557da603c7796d0455cd28f1b7f12e989058583319eb5ad31f27fbd23b64ba75480b3474d62caedec40	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000030ab4a41cf160248ae1764f9bf9519b90000000002000000000010660000000100002000000017a488cb965139d948ed3f07adc2a57be0401d65a0e87ba08178c20953a1b2b4000000000e80000000020000200000008d1380a43855c2202acf9c2ebaf620e587ab0919d77d9d7a75c3b52e1b8bda8d90000000a492c469325e1dba882dbd64c3e7625043ef87e239d54a6101d87cedaf41370980ec52b225c795722a1858a45c66a91b8ed1ae7054d1b3b25f37ab7a96176903481e83cbafe9ec64197ce86fdb2755b06ca590a50c41b664f69a2d43ddbc36034f506ef5c9225cd5ef26bb5b4256bc561ab3fdc0f1f5295e84cc6cd41b4d63daf3c5b2bdf2e0b01f1f45c57e12d37c9440000000845f237cddcdcbbf9c4175f3759153f818ad39d95440965ad3796752889ca34b399b750c92984b9d5c64857429e0d3df8f713b29966ca329c50d3e2d061e6b62	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422604601"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2968	2004	69e831dc3d29a7b5e978336e9bd162ee_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2968	2004	69e831dc3d29a7b5e978336e9bd162ee_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2968	2004	69e831dc3d29a7b5e978336e9bd162ee_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2968	2004	69e831dc3d29a7b5e978336e9bd162ee_JaffaCakes118.exe	28
PID 2968 wrote to memory of 2976	2968	iexplore.exe	29
PID 2968 wrote to memory of 2976	2968	iexplore.exe	29
PID 2968 wrote to memory of 2976	2968	iexplore.exe	29
PID 2968 wrote to memory of 2976	2968	iexplore.exe	29
PID 2976 wrote to memory of 2540	2976	IEXPLORE.EXE	31
PID 2976 wrote to memory of 2540	2976	IEXPLORE.EXE	31
PID 2976 wrote to memory of 2540	2976	IEXPLORE.EXE	31
PID 2976 wrote to memory of 2540	2976	IEXPLORE.EXE	31

C:\Users\Admin\AppData\Local\Temp\69e831dc3d29a7b5e978336e9bd162ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\69e831dc3d29a7b5e978336e9bd162ee_JaffaCakes118.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://down.360safe.com/se/360se6_setup.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.360safe.com/se/360se6_setup.exe
    3⤵
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eca9f371cd39cc34d77b1b70a27697f6

SHA1
3410b768298e163ef3313cc3319c90a1e3915be1

SHA256
9b4366d632b3201df6f5bb8c472a00388acd4f6e75e4c1525539577657615a8a

SHA512
dfec75f03beca45335275dc908f17da8241b530bfb671cb03a6c27c84d14a06f793d31e487e2f0fa8e99a9db838328d7608529ed3487654c2dee659cce0b1eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ff90b63492e9bea328fd7d057b26fb3

SHA1
30c80b15f813f7749f9bf2f2cd7725cc6a2357ec

SHA256
afd12efde4602f1d2959c917d73fdbb15a5941b6486e23fcc1147b2465a09e13

SHA512
0767834ec7430e1e6c9b1d7a3da80c470f067c5634edd14bff812471fe276d8070643e4e7d70fc3b987abf9d3be058397743ceedcaeab689bf4c2ed5be890697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c559bf69d35dcd927876d9c47c78161f

SHA1
4fcb1d9989b59bb6b4c9cbaa2ad2621c347b99b9

SHA256
0d120b4c615837ac54c666939dec0948712562482155faef33847fffc7cdcd35

SHA512
cda205b6794b5d865ff16ace13d4a74418a5b16a9f58bcadc70459a4e5cbe04ac1adabd87a67b494a7fb2e04b232dbf9623a7b9cbfc3f1bcb5e3df6d24ecd2ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa56713058abb3522c939b8dec520d61

SHA1
4967208f63729dae6595637195a5355babe97acd

SHA256
2648690b9b18ebc6596d44ddec4d25b36d60fc46d7e0dd311b39b22a68f2042f

SHA512
92dd23f8d4fa9b594f01fbdb91743ad639350bc8f360924ee545582030bf81190b7f0e75186aa30cb2e61c1966827fe25d11027a627befaf18197403f8ed9a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf7ab71c7088e8c0c8e00e4ca250f64d

SHA1
1e8b4719d1424631c82edcb1a988d9321e99513e

SHA256
1637ed9cea656fb067bef4729de8eebaabcd16196d2422cfa2c54726eabe90fa

SHA512
8865a945063cb0696945a382983aefa8cedb0b923950b7a247b5243365797024060c0393aca9f5a39cb9341b5302d1ed1b1874e57571ac33b038b49bbf5cfc4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ede56b05500d90bed3cd9ff698521ac8

SHA1
61f20cf31e0211f3e9c841be56e5becfd1db3490

SHA256
d7722e96eedbb46f683694631a3412cc2d9f5bed49820a375fcaee296de0a2ec

SHA512
7e25cf7aefa8743cd6e1d175bfc4f3afd8646f8f11d4917cf3904bad3415a4e72326f6a3562356a934510f499987846de2ba1703c0e9f174951bfc7657a81a1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee16dd59a40086ee3effc1ab90930b4

SHA1
5c0c815b6f8cefecdfcd48eea213df78e89d1694

SHA256
f2fcd9324c2a1555bdfe48d5b1be3a37166544c467b631693f3156de7ea9b4e8

SHA512
5a6c99c36499f60891c9d7a29954bda3334b11b0364eeb0bd7c38ee64f3775257403319f176d7ae203a44304b513aa443fe9070542c5b7838a33cbec5af57e3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
461d89417f40cb1656638a1925cb88fb

SHA1
d31eebde7c7aa2a212104b3a4c3f12a7de56d444

SHA256
50eef79057b88fb2f380787cf6d5631c8cbc2c3467728ccbe696fa20ad36c3c4

SHA512
9c87f96e4b1d8838c41e8dc7ccb0fcbe76fd0b3aaf6191fd6294fcf6f1297f4e53bdfeb75befbf3da7eef5178b019dd5172015fd6e6f5baebb85d72f747ec067

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4607.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4766.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/2004-4-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2004-5-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads