d027ef77bbee5aa3c42e9710c2ec0fd151d8c2e4bd76afd826a61dc426fc9cab

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 19:40

Target

1748695394c0f598c1a339a64356c321_JaffaCakes118.exe
Size

1.3MB
MD5

1748695394c0f598c1a339a64356c321
SHA1

198e2bdbb3e021f7c22bff0372765718a97aa94c
SHA256

d027ef77bbee5aa3c42e9710c2ec0fd151d8c2e4bd76afd826a61dc426fc9cab
SHA512

fce77a867800d99b3b43c2b1e55398b2b4daed1f214d91c6dff1a1dd7d554b3b38f2563f058eaf0e75675e7c6485e36ee17efae0fc2a9b823f12caa44cf3abcb
SSDEEP

24576:qhtcNS1GzCeG3XbFZfRPhpjZTnIdtJOjWcCDUiWBwrkel3SlR:qrp1OibFjZTutJOnCDTR0r

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	1748695394c0f598c1a339a64356c321_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	1748695394c0f598c1a339a64356c321_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\IESettingSync	1748695394c0f598c1a339a64356c321_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	1748695394c0f598c1a339a64356c321_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1648	1748695394c0f598c1a339a64356c321_JaffaCakes118.exe
1648	1748695394c0f598c1a339a64356c321_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\errorPageStrings[1]

Filesize
4KB

MD5
d65ec06f21c379c87040b83cc1abac6b

SHA1
208d0a0bb775661758394be7e4afb18357e46c8b

SHA256
a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

SHA512
8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\httpErrorPagesScripts[1]

Filesize
11KB

MD5
9234071287e637f85d721463c488704c

SHA1
cca09b1e0fba38ba29d3972ed8dcecefdef8c152

SHA256
65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

SHA512
87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

Download Submit