c9b4da3d113dfeee1c99e886cc7344bc2a9976b194f8359ac20b6c662f5ee8ae

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Size

1.2MB
MD5

04ec302ec8a309e65d3debf714237310
SHA1

cb7f5f06686bfda15942e6a5678c9cb2e41e0337
SHA256

c9b4da3d113dfeee1c99e886cc7344bc2a9976b194f8359ac20b6c662f5ee8ae
SHA512

b52e91fe34dc888671075a5863bd2c8dedaecae744b6bf55f2af528bbc86c08e2564304edf9df79d6e819be8da6880c73bbc938f53f1611345831b04afc6d0ea
SSDEEP

24576:tWPYFSHs27TFQy1EBOtaUYCEjy5eQ1eKhAudcT3vRDGX7Ful+H2FqZ:gnL1JUsZvdc7vZQul+H2y

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4752-0-0x0000000000400000-0x000000000071B000-memory.dmp	upx
behavioral2/memory/4752-8-0x0000000000400000-0x000000000071B000-memory.dmp	upx
behavioral2/memory/4752-10-0x0000000000400000-0x000000000071B000-memory.dmp	upx

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\04ec302ec8a309e65d3debf714237310_JaffaCakes118.EAPProtocol	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\04ec302ec8a309e65d3debf714237310_JaffaCakes118.EAPProtocol\Clsid	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImagesPPG.ImagesPPG\CLSID\{4c473b38-1105-4ec2-962c-36c8c4ae1283}	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5902C4EB-8397-4FF6-B5D8-741A51D26543}	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5902C4EB-8397-4FF6-B5D8-741A51D26543}\ = "Embedded Async Pluggable Protocol"	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5902C4EB-8397-4FF6-B5D8-741A51D26543}\LocalServer32	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\04ec302ec8a309e65d3debf714237310_JaffaCakes118.EAPProtocol\ = "Embedded Async Pluggable Protocol"	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImagesPPG.ImagesPPG\CLSID	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImagesPPG.ImagesPPG	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5902C4EB-8397-4FF6-B5D8-741A51D26543}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe"	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5902C4EB-8397-4FF6-B5D8-741A51D26543}\ProgID	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5902C4EB-8397-4FF6-B5D8-741A51D26543}\ProgID\ = "04ec302ec8a309e65d3debf714237310_JaffaCakes118.EAPProtocol"	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\04ec302ec8a309e65d3debf714237310_JaffaCakes118.EAPProtocol\Clsid\ = "{5902C4EB-8397-4FF6-B5D8-741A51D26543}"	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4752	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
4752	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
4752	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
4752	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
4752	04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04ec302ec8a309e65d3debf714237310_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4756 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4752-0-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4752-1-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/4752-8-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4752-10-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4752-11-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads