Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 11:26
Static task
static1
Behavioral task
behavioral1
Sample
71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe
-
Size
505KB
-
MD5
71cbd1c0b5c674567a6f5602f0c8bae8
-
SHA1
05450d88c5249bc0cc34b92e9ab9f88b7c3b33e7
-
SHA256
980b6ea42c82086904b7bf6bf79f67194034c635bcf5cee8da0c5049a541acbd
-
SHA512
efc53e62d973d245c44b31c21a474070a1292f6875a0284c8f816bb234b21bec6ab1d46e692854b50a0e7fa2147fd0f062fe2163d4c70dd66536b4cf7c5d6cbb
-
SSDEEP
6144:5USuBd2X6aaO58ssaoteaNv2C+H3A+ro49DYbPQLvf1Q/6k9s9kyb5Go3IWRtFJk:5x0qaOmBsIeCEkiUQL3DS+JRtrKKa
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\dei3122.tmp acprotect -
Executes dropped EXE 2 IoCs
Processes:
71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exeDesktopLayer.exepid process 4528 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe 540 DesktopLayer.exe -
Loads dropped DLL 8 IoCs
Processes:
71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exeDesktopLayer.exeIEXPLORE.EXEpid process 2980 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe 2980 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe 4528 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe 4528 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe 540 DesktopLayer.exe 540 DesktopLayer.exe 3344 IEXPLORE.EXE 3344 IEXPLORE.EXE -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe upx behavioral2/memory/4528-11-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/4528-20-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/540-36-0x0000000000400000-0x000000000042F000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
Processes:
71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe File created C:\Program Files\AppPatch\NetSyst96.dll 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\px3190.tmp 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31108758" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1920229418" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1922104805" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31108758" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108758" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423401358" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1920229418" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9E014BAC-1A89-11EF-A2D1-6AE20D922C8F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108758" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1922104805" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 540 DesktopLayer.exe 540 DesktopLayer.exe 540 DesktopLayer.exe 540 DesktopLayer.exe 540 DesktopLayer.exe 540 DesktopLayer.exe 540 DesktopLayer.exe 540 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1636 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exeDesktopLayer.exeiexplore.exeIEXPLORE.EXEpid process 2980 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe 4528 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe 540 DesktopLayer.exe 1636 iexplore.exe 1636 iexplore.exe 3344 IEXPLORE.EXE 3344 IEXPLORE.EXE 3344 IEXPLORE.EXE 3344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 2980 wrote to memory of 4528 2980 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe PID 2980 wrote to memory of 4528 2980 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe PID 2980 wrote to memory of 4528 2980 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe PID 4528 wrote to memory of 540 4528 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe DesktopLayer.exe PID 4528 wrote to memory of 540 4528 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe DesktopLayer.exe PID 4528 wrote to memory of 540 4528 71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe DesktopLayer.exe PID 540 wrote to memory of 1636 540 DesktopLayer.exe iexplore.exe PID 540 wrote to memory of 1636 540 DesktopLayer.exe iexplore.exe PID 1636 wrote to memory of 3344 1636 iexplore.exe IEXPLORE.EXE PID 1636 wrote to memory of 3344 1636 iexplore.exe IEXPLORE.EXE PID 1636 wrote to memory of 3344 1636 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exeC:\Users\Admin\AppData\Local\Temp\71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:17410 /prefetch:25⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5c41ab5352ba79baac9ac093dd7eb2500
SHA11ffb0e70f86845daba211aeda43cad539d34ffd3
SHA256558e13bb7aa293569457e9703d2db37e8365e2ab670b2c3484ada9336ed24895
SHA512ccebe3f11039e14d39d4102652669fd372d179778bf73fae0659dd01da569bbf850b273cd3a4e13dc77b3fd4fb4d84d01525ac3a0dcb23b297c733da10bc2ff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD51957b11b8939e71410220fea5e0f57b8
SHA1ba561585df4bd3e653e8913d3ff834a53b4d0dc9
SHA25635b9309e59072729d2245cf6778086850345781a07d8e03c30d561b05f03db02
SHA5125cfcc55f6a279dc70af6211e540ab4c4fd854967e0873e6ca3f99f53dd0bed4f98340ec9fbbc178a47efdaea9d4cd8573b89d55503c52871331e66bc321ee264
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA98E.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I3C6LG3F\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\71cbd1c0b5c674567a6f5602f0c8bae8_JaffaCakes118Srv.exeFilesize
228KB
MD53c1d45fc82c3350c1f3b7d83323abd13
SHA156b4678c7bb5c57f2edf878f17ad9825109d891f
SHA2566726ddcd68d91e48cdf2b90da43ccab2ceb4e88b2d072c0c0258608e176b97a2
SHA512b10e7889029e3332ed3fcaa0f3a3583d32b8fd4e442970f53dc273619ba8878bcbf3f538dbc2b235f489aed172b90f242e5ea3c48bdfc9e38bab60cffc5fe743
-
C:\Users\Admin\AppData\Local\Temp\dei3122.tmpFilesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c
-
memory/540-35-0x0000000001F20000-0x0000000001F93000-memory.dmpFilesize
460KB
-
memory/540-34-0x0000000001F20000-0x0000000001F93000-memory.dmpFilesize
460KB
-
memory/540-33-0x0000000002000000-0x0000000002001000-memory.dmpFilesize
4KB
-
memory/540-36-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2980-42-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2980-0-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2980-43-0x0000000000630000-0x00000000006A3000-memory.dmpFilesize
460KB
-
memory/2980-8-0x0000000000630000-0x00000000006A3000-memory.dmpFilesize
460KB
-
memory/2980-78-0x0000000000630000-0x00000000006A3000-memory.dmpFilesize
460KB
-
memory/4528-32-0x0000000002050000-0x00000000020C3000-memory.dmpFilesize
460KB
-
memory/4528-18-0x0000000002050000-0x00000000020C3000-memory.dmpFilesize
460KB
-
memory/4528-19-0x0000000002050000-0x00000000020C3000-memory.dmpFilesize
460KB
-
memory/4528-20-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4528-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB