Analysis
- max time kernel
156s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 13:09
Behavioral task
behavioral1
Sample
a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe
- Size 656KB
- Sample240613-qdw68athmk
- SHA256 338c7bfba54ead35ef7d9562f5fbcd6870ed2e000c0bab7a609fe7a46b849bc0
- MD5 a5b40e9d098838e72d738e9c3e9488bd
- SHA1 460116dca6e81b0173e62e63486f85a0dd496c80
- SHA512 7babf30210cdfab08aca80efc256c7bfa3b0dfde9272ae87442c1ee4529b1e29f59b728b2728fd9c6b2f4f30402e60ed8e1359afc698b92b42347ddf82840771
- SSDEEP 12288:TiVJ/ursQkhepq03yAovfVKVjyydM7mfMGiaGmROCf7QqJBy90pg:TiVpurdkAvFXVjyy677BacobJByig
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4076-0-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-1-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-3-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-5-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-6-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-7-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-8-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-9-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-10-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-12-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-13-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-15-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/4076-18-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/3372-21-0x0000000000080000-0x000000000023F000-memory.dmp upx behavioral2/memory/3372-22-0x0000000000080000-0x000000000023F000-memory.dmp upx - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe = "11001" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe = "11001" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe - Modifies registry class 44 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\CLSID a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\CLSID\ = "{017E057B-DACF-4A07-B878-E294565E3F90}" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe\"" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\FLAGS a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\ = "{F126C9FC-9299-40F2-BD42-C59023AD1E7F}" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\InprocHandler32 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\InprocHandler32\ = "ole32.dll" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\Version = "1.0" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ProgID a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\InprocHandler32\ = "ole32.dll" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967} a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\Version = "1.0" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\0 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\0\win32 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\HELPDIR\ a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ = "ISetup" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\ = "Setup.Application" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ProgID a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\HELPDIR a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\ = "{F126C9FC-9299-40F2-BD42-C59023AD1E7F}" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\CLSID\ = "{017E057B-DACF-4A07-B878-E294565E3F90}" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ = "Setup.Application" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\ = "Setup" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\CLSID a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\LocalServer32 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ProgID\ = "Setup.Application" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\InprocHandler32 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ProgID\ = "Setup.Application" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\FLAGS\ = "0" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ = "ISetup" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967} a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\LocalServer32 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe\"" a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90} a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F} a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 3372 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4076 wrote to memory of 3372 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 100 PID 4076 wrote to memory of 3372 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 100 PID 4076 wrote to memory of 3372 4076 a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5b40e9d098838e72d738e9c3e9488bd_JaffaCakes118.exe" /adm /recovermode2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:4776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\setup[1].htm
- Size 530B
- SHA256 ad8cf259416b47a76397759eae385f3eb83308eb6f8a9bd10fc4bbe914a3e248
- MD5 251dfba5cc623b591047030b18632ff7
- SHA1 9d658897e21fb5088bada54947f38a3b19442f3c
- SHA512 88ddf0561666f80bf4ad001f70ae7dfa2f2647d4878d158e1fdbda429f2ed11f3786a79e76d0e0b2225307bf67e0dc872aa2f23e8292b268962cd2cb7df07f05
- MD5 SHA1 SHA512