e366dd35758d40fde92b3b26fba00bab93757019a4762108eb1083753aa34443

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ddf39be2751479721283781e734eafc_JaffaCakes118.exe
Size

519KB
MD5

9ddf39be2751479721283781e734eafc
SHA1

b30ec138297ba8e59aab88f1c7b47e97c74b6409
SHA256

e366dd35758d40fde92b3b26fba00bab93757019a4762108eb1083753aa34443
SHA512

c4f39b0d960240cfa103591de4e55e0ca875df13f9d4b390342e49c4d5fd7c9e6c4ae180d0ced7e87cbe2d7a2cc4ecc4b13dba96f25b60f49ebad65a97cfcf4c
SSDEEP

6144:1Jj0xNR+JUQWS6KOhaoO9D00qF+8W0qFul7X0qFk7Mpc0qFAlLVK0qFk7O0q71u:L0xNOP6dhaoXyilDCMm8lLkCO0q71u

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1888	vVo118E.exe

Loads dropped DLL 1 IoCs

pid	Process
2468	9ddf39be2751479721283781e734eafc_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	vVo118E.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	vVo118E.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1888	vVo118E.exe
1888	vVo118E.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1888	2468	9ddf39be2751479721283781e734eafc_JaffaCakes118.exe	28
PID 2468 wrote to memory of 1888	2468	9ddf39be2751479721283781e734eafc_JaffaCakes118.exe	28
PID 2468 wrote to memory of 1888	2468	9ddf39be2751479721283781e734eafc_JaffaCakes118.exe	28
PID 2468 wrote to memory of 1888	2468	9ddf39be2751479721283781e734eafc_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\9ddf39be2751479721283781e734eafc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9ddf39be2751479721283781e734eafc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\vVo118E.exe
  C:\Users\Admin\AppData\Local\Temp\vVo118E.exe -domain=iqabrowser.com -env=2 -file=installer -ip=52.1.45.42:80 -pub_id= -setup_id=605 -srcid= -sub_id=
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\vVo118E.exe

Filesize
134KB

MD5
34314d75fb6ed91bd3b01808877bda9c

SHA1
93df7339f40e8a001c0850b898031227497572d5

SHA256
597e86ad778b1ff8b791915a45a45706afdccaff5652329aea41e6dd488a56f8

SHA512
2d8e30cf0297c682ba3cafb8ad9ca61d3e5a6257ac4e805797ff3b5dcd3a5e0b77217927a9e176e503225ac5c26e19228b7dd37c8f07512a04ad0d5fe413aa3d

Download Submit
memory/1888-5-0x000007FEF5893000-0x000007FEF5894000-memory.dmp

Filesize
4KB

Download
memory/1888-6-0x0000000000380000-0x00000000003A6000-memory.dmp

Filesize
152KB

Download
memory/1888-7-0x000007FEF5890000-0x000007FEF627C000-memory.dmp

Filesize
9.9MB

Download
memory/1888-8-0x000007FEF5893000-0x000007FEF5894000-memory.dmp

Filesize
4KB

Download
memory/1888-9-0x000007FEF5890000-0x000007FEF627C000-memory.dmp

Filesize
9.9MB

Download
memory/1888-10-0x000007FEF5890000-0x000007FEF627C000-memory.dmp

Filesize
9.9MB

Download
memory/1888-11-0x000007FEF5890000-0x000007FEF627C000-memory.dmp

Filesize
9.9MB

Download
memory/1888-25-0x000007FEF5890000-0x000007FEF627C000-memory.dmp

Filesize
9.9MB

Download
memory/1888-26-0x000007FEF5890000-0x000007FEF627C000-memory.dmp

Filesize
9.9MB

Download