d4c303836869853e76436ce06055bd8d582655e54daa0509fc190ddc51d74584

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Size

323KB
MD5

06f0e4c379e0d16c8e73441592e18c00
SHA1

0f4bf5a8b3bc4320cfd61b335292e5bd62b54620
SHA256

d4c303836869853e76436ce06055bd8d582655e54daa0509fc190ddc51d74584
SHA512

b0e36c77123bbc548b24fc1f7a2800a14522ec51612db43ab3097a5202ce582a25c5c0bf07ac7ac0be2ba2669a8b7603824d6a6beb64982c4cc8db17a7579bdf
SSDEEP

6144:OBfosESuJD5MhiL6w1NQA+Bw9AxYyFpT5j0M0m5Vit0iiOrlRHxHbAd+TvxleNZm:OBfPUJFneSNvle9jtj0M0m5xlgPiyZg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\IESettingSync	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.MyNSHandler"	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe"	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.MyNSHandler\ = "this is my ebook"	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.MyNSHandler	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.MyNSHandler\Clsid	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3952	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
3952	06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06f0e4c379e0d16c8e73441592e18c00_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-0-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3952-1-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/3952-3-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download