f4e8729a74f85e98ae5c7c8806822f5d8944a411fdbc80f2a31c43b74c4a2660

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0572b79e6bc9e9de97f4149cb20b40c2_JaffaCakes118.exe
Size

27KB
MD5

0572b79e6bc9e9de97f4149cb20b40c2
SHA1

8f363315b8d986439f6d77584134bdc3e8830e53
SHA256

f4e8729a74f85e98ae5c7c8806822f5d8944a411fdbc80f2a31c43b74c4a2660
SHA512

12f60a0ed6dc925328052448d0c264a4985173f3c20395f6759974c030a63830f2ac240a05b90741e8612199e5727489560e84bee4474f5ad17f52a7ecde233d
SSDEEP

384:uBzcwNJVDw7rgopvr7X1exnEit5w8hcaZSty2KzTqG68JhX2nuxm:utc4e/1eSm5BcaZSn8JhX2nu

Score

7^/10

execution upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2976-0-0x0000000000010000-0x0000000000028000-memory.dmp	upx
behavioral1/memory/2976-63-0x0000000000010000-0x0000000000028000-memory.dmp	upx
behavioral1/memory/2976-469-0x0000000000010000-0x0000000000028000-memory.dmp	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000091bd8b2f15b87a4f97672bc1a081321400000000020000000000106600000001000020000000cf2510679ccc0a400b014e668673744792db6b277a485cccc7aa93e146d15da4000000000e80000000020000200000009b3cc17726335d64c1e3c67a94e411113aa6a0b75b53957b61e9b9172b53013a20000000662a0d75fe28abce65d84623d4f8b34762efbf16eedf204d13e5388579053dec40000000e202db39c7c87d59431e4bb741dd8ad622e445a8ebcb2b69ca5a31c7541cb7646b455a16cc9bc0da6c4fef41ee9cc293581d87704f97a67de235d08c94f1de92	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6081a27002c3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B17E391-2EF5-11EF-BECC-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = b104000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000091bd8b2f15b87a4f97672bc1a08132140000000002000000000010660000000100002000000014baa998f1759b0b69d85a8e1f76a833e08ee600884f11df1b08952df92930e2000000000e8000000002000020000000e1089887c303e66a3782d317aa41bad830c32ffad4e8f1fea1a162999ed17c1f900000007d00aa0dcb810f9111d63e476473fa7434f25e058e8918063663f5aba016d75882b4afde9094b08cf3e8a12286f2d5b7007fb39d6aeacca104a53db2bc7039c69a4ab19c51c0d9b41fb9eb95a032521ee404fd519dcab747e8164e330c825be10ada67af8d2e0604f2097c01ee0c2dc8fb7830b457064924d2d08c64dc34a0680f8bdef75f082aaf0a72d9adb537180940000000226e6385a02620c3a0cb99183b29b4b09e789d1fa6dce9ea915b5fd0bb28fc850daae970d87b5a8944c5abc4ed9b6202771182565018237ec7cb94df8402b22f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2596	iexplore.exe
2596	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2988	2976	0572b79e6bc9e9de97f4149cb20b40c2_JaffaCakes118.exe	28
PID 2976 wrote to memory of 2988	2976	0572b79e6bc9e9de97f4149cb20b40c2_JaffaCakes118.exe	28
PID 2976 wrote to memory of 2988	2976	0572b79e6bc9e9de97f4149cb20b40c2_JaffaCakes118.exe	28
PID 2976 wrote to memory of 2988	2976	0572b79e6bc9e9de97f4149cb20b40c2_JaffaCakes118.exe	28
PID 2596 wrote to memory of 2756	2596	iexplore.exe	31
PID 2596 wrote to memory of 2756	2596	iexplore.exe	31
PID 2596 wrote to memory of 2756	2596	iexplore.exe	31
PID 2596 wrote to memory of 2756	2596	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\0572b79e6bc9e9de97f4149cb20b40c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0572b79e6bc9e9de97f4149cb20b40c2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\rBptloWxhm.js" "C:\Users\Admin\AppData\Local\Temp\0572b79e6bc9e9de97f4149cb20b40c2_JaffaCakes118.exe"
  2⤵
  PID:2988

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12430888e83dfb27a3a825282f2b8619

SHA1
94366ac5adea86a203af635c28665ae79bd9396b

SHA256
65ddc56b6d07be95f5ae64588c2bc5b14b7015c26393fd88b7398f9de35c3ed1

SHA512
96f400f379607ab98cf2b39b81b16da52e1cdea44acc93e51ae8997a8796f1993e0b92e2f05e8e68c9886754965debcca78a1ab5ae0a30c50a92c3c332c12446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecfd5523fc203c1e70bd23f7fd89b3c1

SHA1
e5029a1d2779061d9056a18044a101a2918408d5

SHA256
da1cb02f2584f3ec2f74c98ce63b191bfc693ffdf5b11edd951862abc35a8f02

SHA512
620aa2f36243fc7e6aa13097af76a730caf7fc939564c8c6572c6220c54663bf1203b660cf21bdaef500df8335ba7f534eab96dd1e06c1e5b098a80581374bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cefe8862ac905f44327883226677d16

SHA1
a9b5402d3358fd711f463f7d4b6559ab2ed38271

SHA256
ebe95b4abd8a1a755342e3eac3f93f046b363a9dcb01d7d13b2355ab5e92bae8

SHA512
826452efbcccc404b1ade8b7866bc3804fce9b5667c58f13fe669f6b127848aec6ea7ff37bfbf18a9b8c07223722fbed6f91c11f43483c6dc5d06e4cba0925c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d9b52c65e09ffc408452eec5172faf0

SHA1
34641c71ff63d1dfb4395db69a05b3389f1705b4

SHA256
6304d61cbd64eb7e9704068a9a2529a786aabe94167e1bd29d5b3f93d9c8b5e3

SHA512
ecd176312231039142553114e20010478c446ba5ed15463fc5800f4640e97af324fa0f6a713f37b895407e9a0fc74b7a4ae3a8cc8ce33f5f89aaedd695b4795a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b58a5f0461d3867420bffc7f5a10857c

SHA1
5e3ee11dd691ef37a1eb31fc564e2fb04ab7ab49

SHA256
3d676ec4ad6d946a8ed78e6c31365eae4598e6938c48cc318bec4e95c5e01697

SHA512
586869fc02097f5681995e8aa5cff8b9433b024f1aefcaf40cd307e8c1024fca69e5c0765594b59cce39b1db15d3876bce0ce9a5bf7721ec47e3ebcba6eade59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecafd50d77a9b760a1634de661dd2c52

SHA1
2a1bdab171478fe06be6045062264b307729dcdf

SHA256
aed3e1f84d29d2fa40c892cd64d87760c9797bc422390a7e2cd9e20b01817a83

SHA512
5ce497db599befe1803d3ada40f19b5d55fb008079a5ec9f1fa52cb097704f2ba981d30d4891aac45b277bb051b444581b5fb03779e9ecf870368179f4da9917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\favicon[1].htm

Filesize
291B

MD5
b73189024a094989653a1002fb6a790b

SHA1
0c44f096cd1fec253c1fe2fcfcd3c58fe05c402d

SHA256
014c471c07b2bc1b90cf5b46eb8eb60abe3ac278e43cd8fcc7c4e6c8950c592d

SHA512
1bca726835d33847812060c968e5306535f513429de5c90d66942155fd42ff75508dba97da8ca36c6d6e6a8df5a2602fe3be047bb5612ad4e367c6c00e1e50a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3303.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4453.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4592.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\rBptloWxhm.js

Filesize
3KB

MD5
9f50055034c0f294c3d40537d75ce962

SHA1
03a5942c93a5200c1eadca46e5a643be09799cb1

SHA256
f175328956703539526145089f6522958c3136702b0627e92adfadddbcf976f5

SHA512
7151e876aa308eb19df457dc73960d21bad0f0cd5e032752e2b846c1368c47c709a5afa531ab7229395a5867ee08930ac3ac9f8784e78909c9e66d8c4837ca3b

Download Submit
memory/2976-63-0x0000000000010000-0x0000000000028000-memory.dmp

Filesize
96KB

Download
memory/2976-0-0x0000000000010000-0x0000000000028000-memory.dmp

Filesize
96KB

Download
memory/2976-469-0x0000000000010000-0x0000000000028000-memory.dmp

Filesize
96KB

Download
memory/2988-59-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download