83558ecdeb341d29b65dd7731af24ea26c1fa86940f9abd27066ee61a16eccf2

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1035910c458ad2c8e71d485cf739c990_JaffaCakes118.exe
Size

450KB
MD5

1035910c458ad2c8e71d485cf739c990
SHA1

03489c1be8f312ccfe975165bcb6356441b6be49
SHA256

83558ecdeb341d29b65dd7731af24ea26c1fa86940f9abd27066ee61a16eccf2
SHA512

9fb6e6bad8a529dfcdc1e43b0fcfd65bedca8d976564817562594ef7d9cf6a4930f8007c54269d1aa9eb1ac025b3bc444c2481ea7a8cd93b2507b2d45d24969d
SSDEEP

6144:O1yxvDIgJW6hK4Ts0O9SvzXvsgOj30uYEDhvfdoP80TXdImGLLcZwOnrq1vdnXO:bXJVzXSYuFvlmXWOrW

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1180-0-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	1035910c458ad2c8e71d485cf739c990_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	1035910c458ad2c8e71d485cf739c990_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
21060	1180	WerFault.exe	87

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main	1035910c458ad2c8e71d485cf739c990_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1180	1035910c458ad2c8e71d485cf739c990_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1180	1035910c458ad2c8e71d485cf739c990_JaffaCakes118.exe
1180	1035910c458ad2c8e71d485cf739c990_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1035910c458ad2c8e71d485cf739c990_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1035910c458ad2c8e71d485cf739c990_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 1324
  2⤵
  - Program crash
  PID:21060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1180 -ip 1180
1⤵
PID:21036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2224,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:21116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1180-1-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/1180-2-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1180-5-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1180-6-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1180-65033-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1180-65031-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download