461bc6ec70f4ff311bf48212a4f4bdf89992df6d852dcbda7c298516350bd0e4

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe
Size

124KB
MD5

26fd6c92e3a674b0867a61fe0ae6ce9c
SHA1

fd33c20f398251632db5ecc896aaf47254429c5f
SHA256

461bc6ec70f4ff311bf48212a4f4bdf89992df6d852dcbda7c298516350bd0e4
SHA512

ff03e5767d4f2ed7119e572503a99c3bd63bb51cf112b873901df955e3a9fb86b7f9d071b28258825de1846d0015af4bea1f9b1815c8a6d04130216a66a1eb17
SSDEEP

768:F40vn8Soqg/Y6YQXNvP6znrwN3m1zty1IhB+j4pt8DtWKVKnpRKwRMGK2iLI+8Sp:d7oqg/YPQgzkKiIhk8pt84baUK2iM9S

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Internet Explorer = "iexplore.exe"	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2804	iexplore.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Internet Explorer = "iexplore.exe"	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows Internet Explorer = "iexplore.exe"	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\iexplore.exe	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\iexplore.exe	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3320 set thread context of 1288	3320	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe	83

Program crash 2 IoCs

pid	pid_target	Process	procid_target
388	3320	WerFault.exe	81
2312	3320	WerFault.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 1288	3320	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe	83
PID 3320 wrote to memory of 1288	3320	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe	83
PID 3320 wrote to memory of 1288	3320	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe	83
PID 3320 wrote to memory of 1288	3320	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe	83
PID 3320 wrote to memory of 1288	3320	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe	83
PID 1288 wrote to memory of 2804	1288	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe	91
PID 1288 wrote to memory of 2804	1288	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe	91
PID 1288 wrote to memory of 2804	1288	26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Users\Admin\AppData\Local\Temp\26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\26fd6c92e3a674b0867a61fe0ae6ce9c_JaffaCakes118.exe
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\iexplore.exe
    "C:\Windows/system32\iexplore.exe"
    3⤵
    - Executes dropped EXE
    PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 376
  2⤵
  - Program crash
  PID:388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 380
  2⤵
  - Program crash
  PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3320 -ip 3320
1⤵
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3320 -ip 3320
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\iexplore.exe

Filesize
124KB

MD5
26fd6c92e3a674b0867a61fe0ae6ce9c

SHA1
fd33c20f398251632db5ecc896aaf47254429c5f

SHA256
461bc6ec70f4ff311bf48212a4f4bdf89992df6d852dcbda7c298516350bd0e4

SHA512
ff03e5767d4f2ed7119e572503a99c3bd63bb51cf112b873901df955e3a9fb86b7f9d071b28258825de1846d0015af4bea1f9b1815c8a6d04130216a66a1eb17

Download Submit
memory/1288-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1288-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1288-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1288-10-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3320-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/3320-7-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads