3ce6061c6ba624ee1cfef7e08127aa8e1287c413ea15a0ce174f830920a9582d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
Size 769KB
Sample240614-e7sv4sygrp
SHA256 3ce6061c6ba624ee1cfef7e08127aa8e1287c413ea15a0ce174f830920a9582d
MD5 a804ece5d512a297f3a16f2752e9722a
SHA1 b0918998b1359b138442a6546e8bc22c8c93090d
SHA512 43043d19d8fa47c2b271fe28977eaa43920de6515344e07fee1a565c797e4931f204e833864a9fa5bf72165e64580bc36dedb77d3b8b5180fd1d241cdb028b6a
SSDEEP 24576:ncP9Edni7Ccb4DUZDIIHscLOll8EuTm4Av004bJd5A8f:clwniwAJssOHuTm4Av0LbSU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
4240	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
4240	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
4240	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
4240	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
4240	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
4240	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
4240	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\IESettingSync	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4240	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
4240	a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a804ece5d512a297f3a16f2752e9722a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb3D58.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

loading.html

Path C:\Users\Admin\AppData\Local\Temp\nsb3D58.tmp\loading.html
Size 3KB
SHA256 cf7c0a8543725a0d29e29b36273b64256b6d0e574a04ede6396f51d74aa0c25b
MD5 aba9d87b34bfc10cae08bc6af020afcc
SHA1 41972139244c88348873d4504038a1d17c1d986a
SHA512 704f14877104dd085db5e41fab81637f890dedb59527b6297e93c706797d2e44428663edfaa3c4ace513aa62c3e08484a6362c24438905feafcde4546e458a7c
MD5 SHA1 SHA512

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb3D58.tmp\nsDialogs.dll
Size 9KB
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsNHTML.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb3D58.tmp\nsNHTML.dll
Size 57KB
SHA256 ec84a8421ca1fd52674a56567a765429145091cb54e2f403f4f67609ec3f1558
MD5 84fa49e195b4aae7306d5db390460f09
SHA1 ffdd8ae60ac68845666822a4e7a4947716c53373
SHA512 c19afeb8b899a9cf170fec6ea04cdbbcf517960f1076b35a6bdac0efd405ed5ed619198c6f03b971cec0a8508579ef3a6a1faf10bb5a3bc4e4ccd43643111361
SSDEEP 768:YQY2zS952oBE3Ki+b+2RyxwyL1Aws5yMktpQ69ZT4XPA3Lu:NYvaoeKi+izwyL/yyMktpQfXPgq
MD5 SHA1 SHA512 SSDEEP

Submit Download

registry.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb3D58.tmp\registry.dll
Size 24KB
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4240-17-0x00000000035E0000-0x0000000003639000-memory.dmp

Download

memory/4240-27-0x0000000003640000-0x0000000003651000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads