6e28a1eb98aef66d7c0103e3a88dcf0052fbb4b0262dd7f70e110452737ae5cf

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17035a233b766a61a98609e7fa0afd20_JaffaCakes118.exe
Size

284KB
MD5

17035a233b766a61a98609e7fa0afd20
SHA1

a31a56c55de22f5366fa93de41b2496b3a7605c9
SHA256

6e28a1eb98aef66d7c0103e3a88dcf0052fbb4b0262dd7f70e110452737ae5cf
SHA512

8a396e85cafd833f6030ae307ebb1eff2fae969dee03d07141ecf7eff7a23535ebacfe98e7a5b0a6430d061883cda6e103a4a8bbb246728367dee931b180e875
SSDEEP

6144:465/fUNTJx+nDGZ7j6JkJS7LVt0H9wEijOxAQy4q2ftluSxpsjiyKSeF:NhUNzODGZsXg9Xij3bz2HJEjiyKVF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1344	mcse.dll

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\mcse.dll	17035a233b766a61a98609e7fa0afd20_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\mcse.dll	17035a233b766a61a98609e7fa0afd20_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	17035a233b766a61a98609e7fa0afd20_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mcse.dll
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mcse.dll
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mcse.dll
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mcse.dll
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mcse.dll

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	17035a233b766a61a98609e7fa0afd20_JaffaCakes118.exe
Token: SeDebugPrivilege	1344	mcse.dll

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1344	mcse.dll

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1588	1344	mcse.dll	86
PID 1344 wrote to memory of 1588	1344	mcse.dll	86
PID 1472 wrote to memory of 3192	1472	17035a233b766a61a98609e7fa0afd20_JaffaCakes118.exe	91
PID 1472 wrote to memory of 3192	1472	17035a233b766a61a98609e7fa0afd20_JaffaCakes118.exe	91
PID 1472 wrote to memory of 3192	1472	17035a233b766a61a98609e7fa0afd20_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\17035a233b766a61a98609e7fa0afd20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17035a233b766a61a98609e7fa0afd20_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:3192

C:\Program Files (x86)\Microsoft Office\mcse.dll
"C:\Program Files (x86)\Microsoft Office\mcse.dll"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:1588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\mcse.dll

Filesize
284KB

MD5
17035a233b766a61a98609e7fa0afd20

SHA1
a31a56c55de22f5366fa93de41b2496b3a7605c9

SHA256
6e28a1eb98aef66d7c0103e3a88dcf0052fbb4b0262dd7f70e110452737ae5cf

SHA512
8a396e85cafd833f6030ae307ebb1eff2fae969dee03d07141ecf7eff7a23535ebacfe98e7a5b0a6430d061883cda6e103a4a8bbb246728367dee931b180e875

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
532af83e9ade2d6d863e3a02da6aaa60

SHA1
aeb9f35ee6042dfd58a36877784636b21804a4c1

SHA256
1ffb56a4b8de3386cc4221c76e37361ab017a22310f581a18d86d9296e1d14dd

SHA512
0519d294ac1c04328ad5f34c76eb842d33daf8c33e11e39b6d574ca37d0fa4e488860dfe475e0d7be230c4870986f7bba3d85db976b264d3defc7295de198bc2

Download Submit
memory/1344-9-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1344-7-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1344-8-0x0000000000400000-0x000000000051101C-memory.dmp

Filesize
1.1MB

Download
memory/1344-13-0x0000000000400000-0x000000000051101C-memory.dmp

Filesize
1.1MB

Download
memory/1344-15-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1344-16-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1344-17-0x0000000000400000-0x000000000051101C-memory.dmp

Filesize
1.1MB

Download
memory/1344-23-0x0000000000400000-0x000000000051101C-memory.dmp

Filesize
1.1MB

Download
memory/1472-2-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/1472-0-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/1472-1-0x0000000000400000-0x000000000051101C-memory.dmp

Filesize
1.1MB

Download