Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 07:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe
-
Size
68KB
-
MD5
040f498e3cc3c3a709c37cdabb0b49ee
-
SHA1
739812e4c96e17f950065789a61e602deaf47953
-
SHA256
f0e9959742704667a779343a3f852c1bb7d71fce9910c0d8112a97e757be61b0
-
SHA512
e1fc984e7bf2e88fc324820ed3d61a41c773e0c73e17c19437348508b9f24e3365917293cbba2ebc0783786cb2642315516ce293ee3065935b6929997d093ae0
-
SSDEEP
1536:Noql/mQR0VSUfXJVMqFVaQbXwlK4iGOpBlg40TFzQF/QoEWfV:mgAfXfyeN4rP4/hEyV
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56F9B9E2-1152-4DB9-93BE-4F5E848C7E60} 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe -
Drops file in Program Files directory 3 IoCs
Processes:
040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exedescription ioc process File created C:\Program Files\Internet Explorer\PLUGINS\Windows64.Jmp 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\PLUGINS\Windows64.Jmp 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\PLUGINS\Windows64.Sys 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe -
Modifies registry class 5 IoCs
Processes:
040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56F9B9E2-1152-4DB9-93BE-4F5E848C7E60}\InProcServer32\ = "C:\\Program Files\\Internet Explorer\\PLUGINS\\Windows64.Sys" 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56F9B9E2-1152-4DB9-93BE-4F5E848C7E60}\InProcServer32\ThreadingModel = "Apartment" 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56F9B9E2-1152-4DB9-93BE-4F5E848C7E60} 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56F9B9E2-1152-4DB9-93BE-4F5E848C7E60}\ 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56F9B9E2-1152-4DB9-93BE-4F5E848C7E60}\InProcServer32 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exedescription pid process target process PID 1272 wrote to memory of 4804 1272 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe PID 1272 wrote to memory of 4804 1272 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe PID 1272 wrote to memory of 4804 1272 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe 040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\040f498e3cc3c3a709c37cdabb0b49ee_JaffaCakes118.exe" Z2⤵
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
PID:4804