Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 13:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe
-
Size
368KB
-
MD5
16297417249fc5a5a7e67ad3683b3e39
-
SHA1
cd1d2549fbac2c16f19c1984a1fc13de1969dd57
-
SHA256
d5afff7dd5795d354f632a477b2447fd2727f3c7d95a436e8b126ca405c00523
-
SHA512
2ed414d506e3543b489ac5f181fe50f9dc8961dd200ee21475dd52655ef4b1223d0acaaf841229826cc3581faa125f11b2df8c92034550efd18a4a14c2bac0aa
-
SSDEEP
6144:QLmT+EspuHqBbnJvaGD5agx2FcTRrdQgxjfEN1o:QLmT+vpuKBbnJv7D5lQgxjfU1o
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C693C147-3488-11EF-B1BC-663BBECB1CCD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 2676 iexplore.exe 2676 iexplore.exe 4540 IEXPLORE.EXE 4540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 212 wrote to memory of 2676 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 82 PID 212 wrote to memory of 2676 212 16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe 82 PID 2676 wrote to memory of 4540 2676 iexplore.exe 83 PID 2676 wrote to memory of 4540 2676 iexplore.exe 83 PID 2676 wrote to memory of 4540 2676 iexplore.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16297417249fc5a5a7e67ad3683b3e39_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "http://www.yxdown.com/count.html"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4540
-
-