Analysis

  • max time kernel
    141s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 06:36

General

  • Target

    03b058b5ba680018530fa9a2a301b0df_JaffaCakes118.exe

  • Size

    9KB

  • MD5

    03b058b5ba680018530fa9a2a301b0df

  • SHA1

    9acacc1135c765566b143021af2e80f10f1b9176

  • SHA256

    6b99e2091dcf1fe037c7f5202bb7500021b2f69ce5f1866c010d8201a70d1897

  • SHA512

    7e997ef3795737abc801475ade7a2c403ffac0e53358348ba6f6c711099b00b46a1a218c331b543112241659463e210411d68a67e7ec61db99d5f71ddefd081b

  • SSDEEP

    192:+9zOLgbhUmfAFdn4XAbr2wltAXTV6vrSCMXtbnOk+4tpnM:+fVod4XA+wleXh+YndRn

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 3 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03b058b5ba680018530fa9a2a301b0df_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\03b058b5ba680018530fa9a2a301b0df_JaffaCakes118.exe"
    1⤵
    • Modifies firewall policy service
    • Windows security bypass
    • Windows security modification
    • Installs/modifies Browser Helper Object
    • Modifies Internet Explorer Protected Mode
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4392-0-0x0000000000490000-0x0000000000492000-memory.dmp

    Filesize

    8KB

  • memory/4392-1-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/4392-3-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB