Overview

overview

7

Static

static

3

087ba21450...18.exe

windows7-x64

7

087ba21450...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-06-2024 12:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    087ba2145094b22f951a49afdfda3239_JaffaCakes118.exe

  • Size

    172KB

  • MD5

    087ba2145094b22f951a49afdfda3239

  • SHA1

    19b17a6c7b676770ca34b7c554c1ecbced427a8d

  • SHA256

    3efc1ca8c300134b53a71039cb21fd43306a31773a3a9b755d927ee92fe727c5

  • SHA512

    e38741bb07edbe33523f25623405307c5831f1a7d335ae3c811418c8f209cb25e58d5a088e8c9b731d83f0e60d201633637437757a369d09a553f2b0d7a2b657

  • SSDEEP

    3072:6uZgPi91VPdIuG8UvahsdcYX3UI2EuJ3im/ZCdady+RlTp/VYq63+s:6ZPi9PBUyhsdEI2++M+RlTHY

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\087ba2145094b22f951a49afdfda3239_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\087ba2145094b22f951a49afdfda3239_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1264
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:3224
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:100
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:100 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1560

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\msi.html
      Filesize

      1KB

      MD5

      403ace9a626495f4493ed25dd87f4781

      SHA1

      f84519d709367a64951ca9f258fcff78e1d7ca2f

      SHA256

      e2c4dbef190d5c9430c6cc0b4bf38869b3f28727b9727f6d5ff2198565cb1b6a

      SHA512

      f67ed322899d912270a111e516275f8b2597f59d2e35b4a34f35d154735eb3d4093f3a5bfd55fa2d52d059782d3a96760db70939238055abc23316329cacb9ad

      Download Submit

    • C:\Windows\SysWOW64\MSWINSCK.ocx
      Filesize

      121KB

      MD5

      e8a2190a9e8ee5e5d2e0b599bbf9dda6

      SHA1

      4e97bf9519c83835da9db309e61ec87ddf165167

      SHA256

      80ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311

      SHA512

      57f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee

      Download Submit