4d368f0772bcb89e211c92c70d29f3540afbefb0cb7567b69bde99d190f67a10

Analysis

max time kernel
92s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe
Size

42KB
MD5

27368a062dfb5115722356e9c178f40c
SHA1

7abfd2b0ef2ec15197d0c2bd466bcc8bdd07ac94
SHA256

4d368f0772bcb89e211c92c70d29f3540afbefb0cb7567b69bde99d190f67a10
SHA512

26b287117a2852be39936552ef540704530451455e2ed097e1a752fd0d6e16243645ed19c2ad209a2ac5f182cec6777ac28f2e2ee935e3d2a437bd02e9541680
SSDEEP

768:kjGwQhoBl3KGryrtHR+SafO68PjCf7QM+NKgwjkwkwhT:kjG4KUgxbqe6QJwjksZ

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSSMSGS = "rundll32.exe winlkj32.rom,SaKRun"	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winlkj32.rom	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winlkj32.rom	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31117110"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31117110"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426988428"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1055169235"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1055169235"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31117110"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1058452916"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6A78AE7E-3B29-11EF-A0CA-5A1F3CBF1B84} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
4728	IEXPLORE.EXE
4728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4556	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	85
PID 2428 wrote to memory of 4556	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	85
PID 2428 wrote to memory of 4556	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	85
PID 4556 wrote to memory of 3012	4556	cmd.exe	87
PID 4556 wrote to memory of 3012	4556	cmd.exe	87
PID 3012 wrote to memory of 4728	3012	iexplore.exe	89
PID 3012 wrote to memory of 4728	3012	iexplore.exe	89
PID 3012 wrote to memory of 4728	3012	iexplore.exe	89
PID 2428 wrote to memory of 3012	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	87
PID 2428 wrote to memory of 3012	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	87
PID 2428 wrote to memory of 3012	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	87
PID 2428 wrote to memory of 3012	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	87
PID 2428 wrote to memory of 1624	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	90
PID 2428 wrote to memory of 1624	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	90
PID 2428 wrote to memory of 1624	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	90
PID 2428 wrote to memory of 1424	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	91
PID 2428 wrote to memory of 1424	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	91
PID 2428 wrote to memory of 1424	2428	27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27368a062dfb5115722356e9c178f40c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start iexplore -embedding
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -embedding
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\gos8F01.bat"
  2⤵
  PID:1624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\27368a062dfb5115722356e9c178f40c_JaffaCakes118.bat"
  2⤵
  PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q42GXF10\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\27368a062dfb5115722356e9c178f40c_JaffaCakes118.bat

Filesize
305B

MD5
020e8ad5bd43b59661f41ab99a3ed5f2

SHA1
601fdd2d5ae8305a88f6372277ebc3fd6e036c54

SHA256
d44e84ac565adc63409994e48244d75f391a6bbf8aeef9792134aecc3f03a18a

SHA512
ea8c3a97fb43de89b5f1bba29a8c8ea4d902be99a6a3c3ab052e21b2e9c9459f1f27c2da19d7d632bdd9cee8709cae9f2cd1d2a7166edfc0d6e1e699882786e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\gos8F01.bat

Filesize
188B

MD5
33469305086ff4101626d05cd18e1b78

SHA1
7801520b290bd086e5557162297cd5886c683743

SHA256
367624962f6bcea2a900ddfaa3e89562efec89c8ba2b6633758590b50bc6dbdd

SHA512
b490e53af510d9772e837b23ff935ebc708cc43d25c706e4159b47a62d719f16f98af3910f423fcb58b43b37d4e6f01b7380089febbb8fe843ef29281bbd56a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\gos8F01.tmp

Filesize
31KB

MD5
2ba0013117ca8ec104c937ae2b7e8c26

SHA1
33a4858f7bb1b40e15f65fd4e385ad9e732d999c

SHA256
6b865694f1886052641f35155b03ba6757ba63b420731133e2013a527d7e00f8

SHA512
c26adf09d4ef5705b4a9d1d8f4e18f4abbac83a2d5667cf4ab9f5ba43b903d5bfa074f732e45f0d8d811385e86180c274d9a36450f71907e05f58d4e2ecf05d0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads