Analysis
-
max time kernel
143s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 08:15
Behavioral task
behavioral1
Sample
1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
1a8fd552bf75d8d4934b30711ea7a38f
-
SHA1
5d999fffeba23f51fbf26b8bd0bcf3f45bbd4230
-
SHA256
ef64d6d97fbc044ce543537dfe9bdc319f8132238010d59b42b1d2c9783db4f2
-
SHA512
001f5bfe6cf971b63f1c019cc86cd52290d10f0aa5f32dbe41b094ca6a8156d14fbfe062d1d3ce3600f13aab4b1161cd4f1c73236d21678fb726299ac1854784
-
SSDEEP
24576:vZIfYChG6xl+UOj7pyLdqXKo3bpY/ZTCTWRM7k3fXEV:Cjn+9PpyBqaVhsfg3fXEV
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\MenuExt\ POTU:¶©ÔÄÑ¡¶¨µÄRSSµØַƵµÀ 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\ POTU:¶©ÔÄÑ¡¶¨µÄRSSµØַƵµÀ\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Common\\getselect.htm" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\ POTU:¶©ÔÄÑ¡¶¨µÄRSSµØַƵµÀ\Contexts = 10 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\MenuExt\ POTU:¶©ÔÄRSSµØַƵµÀ 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\ POTU:¶©ÔÄRSSµØַƵµÀ\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Common\\geturl.htm" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\ POTU:¶©ÔÄRSSµØַƵµÀ\Contexts = "34" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe -
Modifies registry class 39 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\potu\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\feeds\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\feeds\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe %1" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ZBT\ = "zbtinns" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zbtinns\ = "POTUƵµÀ²å¼þ" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zbtinns\Shell\open 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zbtinns\Shell\open\Command 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rss\DefaultIcon 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\feeds\shell\open 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\potu 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\potu\DefaultIcon 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\potu\shell 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zbtinns\DefaultIcon 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rss\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\feeds\DefaultIcon 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\feeds\ = "URL:rss Protocol" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\potu\shell\open\command 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rss\URL Protocol 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rss\shell\open\command 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\potu\shell\open 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zbtinns\Shell 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zbtinns\Shell\open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe %1" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rss 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rss\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe %1" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\potu\URL Protocol 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\potu\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe %1" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ZBT 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zbtinns\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe,0\"" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rss\ = "URL:rss Protocol" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\feeds\shell\open\command 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\potu\ = "URL:rss Protocol" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zbtinns 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rss\shell\open 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\feeds\shell 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\feeds\URL Protocol 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zbtinns\Shell\ = "Open" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zbtinns\Shell\open\ = "´ò¿ª" 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rss\shell 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\feeds 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe 4160 1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a8fd552bf75d8d4934b30711ea7a38f_JaffaCakes118.exe"1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4160
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵PID:4592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD5e06bb5c57db9afd791c81103eb74a57b
SHA1861cb125f20008eca74483511dfbdffdec5776aa
SHA25603fe3933c4be3d23d11c89dc53a99638fc0a75b0e3c9608adafda685f85af40d
SHA51203e34a999e998f8d244815912939cca02865bb02de635f9f3cf170453e270c872448c3a16fde75a7b6b6aa2fa24d0c9a4c5e754e96fab54b7e7ee69a9116f7f7