1784ba9a33f835b54a3eebfaffe4029f08c3e48694ea23c03b293b15fc8c3c50

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Size 824KB
Sample240619-vb469syejm
SHA256 1784ba9a33f835b54a3eebfaffe4029f08c3e48694ea23c03b293b15fc8c3c50
MD5 bd58e0da69152dbe367bab0b88901c8d
SHA1 264e33882e64dc81298a2d61eb5faec629e98f0a
SHA512 422bdeafd55363b6c78c3e9ad960f96125d2bb8b1574e20c26e2dbde07f8a3c685933beab15d9b59b7a2cee2c9733366e1956fe9db66cb4a633d7ab5827e05e2
SSDEEP 12288:Rb+17yMcfzdaFJfyz7Sn5wL1EBxJ2tST+D46FBiTOh4f22F8POtaBk3GzV8P/:Ry+fzdI4zO5wL1EMI0LFBi7en6EaH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion persistence privilege_escalation trojan

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS\ = "0"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\ = "TinyJSObject Class"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version\ = "1.0"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\ = "JSIELib"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib\ = "{7E77E9F2-D76B-4D54-B515-9A7F93DF03DF}"	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2916	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
2916	bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bd58e0da69152dbe367bab0b88901c8d_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3108 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2916-9-0x0000000075CC0000-0x0000000075CC1000-memory.dmp

Download

memory/2916-2-0x0000000003570000-0x00000000036B1000-memory.dmp

Download

memory/2916-10-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-11-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-12-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-13-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-14-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-15-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-16-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-24-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-25-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-26-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-27-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-28-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-29-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-30-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

memory/2916-31-0x0000000075CA0000-0x0000000075D90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads