c867c32ec4377fbe6fe68a3cd42b61e822e9eef58dd00331303c4e20c27a6395

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe
Size

336KB
MD5

15270a9e11bcbc191893589b57c445cd
SHA1

35c228ecbcc48ddb14bdf3d4484b3b447a6cd5a7
SHA256

c867c32ec4377fbe6fe68a3cd42b61e822e9eef58dd00331303c4e20c27a6395
SHA512

ea6b654140efe87982704d20b2040f12088922e67dd7a8e18842b667f38025b3d8ad1e9a38709c84da586741d7a63ecbda28fc34cdebad059fee9e3f54aad7a1
SSDEEP

6144:LrlBuElYOp9tNgv0Ko+mrpftv5AfA7qmMwYz:LbjlBtOv0Vtv5Af0qJzz

Score

7^/10

evasion trojan

Malware Config

Signatures

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Microsoft Antimalware\SpyNet	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Microsoft Antimalware\SpyNet\SpyNetReporting = "0"	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3380 set thread context of 1504	3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	81

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2996119262"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115363"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DE32C305-3456-11EF-A084-CEC6030110C3} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115363"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426238291"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2997837822"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115363"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2996119262"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2997837822"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115363"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1504	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe
1504	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe
1504	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe
Token: SeDebugPrivilege	1468	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 1504	3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	81
PID 3380 wrote to memory of 1504	3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	81
PID 3380 wrote to memory of 1504	3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	81
PID 3380 wrote to memory of 1504	3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	81
PID 3380 wrote to memory of 1504	3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	81
PID 3380 wrote to memory of 1504	3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	81
PID 3380 wrote to memory of 1504	3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	81
PID 3380 wrote to memory of 1504	3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	81
PID 3380 wrote to memory of 1504	3380	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	81
PID 1504 wrote to memory of 5068	1504	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	86
PID 1504 wrote to memory of 5068	1504	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	86
PID 1504 wrote to memory of 5068	1504	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	86
PID 5068 wrote to memory of 3012	5068	iexplore.exe	87
PID 5068 wrote to memory of 3012	5068	iexplore.exe	87
PID 3012 wrote to memory of 1468	3012	IEXPLORE.EXE	88
PID 3012 wrote to memory of 1468	3012	IEXPLORE.EXE	88
PID 3012 wrote to memory of 1468	3012	IEXPLORE.EXE	88
PID 1504 wrote to memory of 1468	1504	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	88
PID 1504 wrote to memory of 1468	1504	15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe"
1⤵
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\Temp\15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\15270a9e11bcbc191893589b57c445cd_JaffaCakes118.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
5f0847e5a15af2d7923393c3cd30c5d1

SHA1
326c44f2bc29ec6578a400d6d46361efcb013540

SHA256
28766e681bf500e9cddbcd3275cd898c4165354ad087c2461d9ee374a7e2221e

SHA512
a83751183cd1f2ac063a0077f8edfaecda72a4649437070c83f88151c822ff42d43fb8a291c123af2598e10d15cbdc147cef353b2149baca9462fb02e3d67a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
e561e1820f34baa07e2c872fd1388abe

SHA1
61cd71cb79914e7328f1889be0e8cff2be1885ae

SHA256
045ffa05376c863597db873a0259f39400d87b082eb783e73c2e01467336002f

SHA512
0a681ad2d7ba489cd2a6e3955644cbc2067b35f8390abb21e20c2f577d3b6575c2735a27104eef08e0eb8ff350d5167b72066b71e232fbf0af23c199b1ae5029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD820.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
memory/1504-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1504-4-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1504-5-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1504-6-0x00000000025C0000-0x000000000260E000-memory.dmp

Filesize
312KB

Download
memory/1504-8-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download