Analysis
-
max time kernel
92s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
282f86a04e990fce476f7306501214fe_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
282f86a04e990fce476f7306501214fe_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
282f86a04e990fce476f7306501214fe_JaffaCakes118.exe
-
Size
2.5MB
-
MD5
282f86a04e990fce476f7306501214fe
-
SHA1
9f19b01282e74d3a227be0640b63d54e68a255c4
-
SHA256
a66f840e87cebc9690667985cbc6c30ceb8863e8b2979c97a3c6c7e2734636d7
-
SHA512
e8dbdf639130154911beaaa1b91b0a746257ed0096cdd3bc398bdd229e2e3311d1ebbd4f8bfcaaa5c30f9c01366174c7eb33386f41acb0d131039b49d5e11155
-
SSDEEP
24576:12VdF+6GLKOdUJW1MQTZaqdiXSp0c02uFG6dAk392KNfsbCwFH4JjOVxQh2kmVmO:12VVuqJ8TZaqdwk0c05HGiDI6JeIZOJ
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00070000000234ca-2.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Control Panel\International\Geo\Nation 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 3724 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe -
resource yara_rule behavioral2/files/0x00070000000234ca-2.dat upx behavioral2/memory/3724-6-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/3724-35-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1962141771" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\IESettingSync 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c48e758dcfda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427025885" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31117197" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31117197" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31117197" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cb2fc91f87190e4194d42416469b424e00000000020000000000106600000001000020000000d9fef6e94c077eb79c187a028cc593038024b369bd9e1cbf31102f4d499525ff000000000e80000000020000200000001e0c715024858dfb61a509553c761d8427a46d63d8a7322fd9032a8d90b51bff2000000048d4a41f629ee5074de784d11098cd596ee98866ae4c93b98427248ec87c05154000000028aea8383a84a94d69bf9d5a9e3cd966819524f909ee01a10c67a0d1a063d143dcd9a1de206cd1a4d01c82b48e59322ed0ead8b48d034d9288275e726e1a9987 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1964329299" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cb2fc91f87190e4194d42416469b424e000000000200000000001066000000010000200000008eaf50b48490f12731c086c2274641e89db40b731ef358aad26531bbcf2dff4e000000000e8000000002000020000000baa26a14115ae74be030e93c8d260b43e8154f276d1e4b4dbc269a013bb1f00620000000f4dba81c63e89f634b714a702d56bd0d3cf8217ee6bde705b215470b9600d653400000006abef2e04ca981b0d3c388cab12a56e5e2f9fb8ee682a66625e90a1884d48bff573cf0b79d0d8ba35fc3ff0e90e024f43d05c4b697f87d3e7d78a3d93460d5e6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1962141771" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706198758dcfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A0A23407-3B80-11EF-A2B8-66F5E5436901} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3724 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe 3724 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3540 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 3724 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe 3724 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe 3724 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe 3724 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe 3540 iexplore.exe 3540 iexplore.exe 3724 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe 908 IEXPLORE.EXE 908 IEXPLORE.EXE 908 IEXPLORE.EXE 908 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3724 wrote to memory of 3540 3724 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe 85 PID 3724 wrote to memory of 3540 3724 282f86a04e990fce476f7306501214fe_JaffaCakes118.exe 85 PID 3540 wrote to memory of 908 3540 iexplore.exe 86 PID 3540 wrote to memory of 908 3540 iexplore.exe 86 PID 3540 wrote to memory of 908 3540 iexplore.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\282f86a04e990fce476f7306501214fe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\282f86a04e990fce476f7306501214fe_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://bbs.3996.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:908
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
4KB
MD5d65ec06f21c379c87040b83cc1abac6b
SHA1208d0a0bb775661758394be7e4afb18357e46c8b
SHA256a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
SHA5128a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e
-
Filesize
11KB
MD59234071287e637f85d721463c488704c
SHA1cca09b1e0fba38ba29d3972ed8dcecefdef8c152
SHA25665cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
SHA51287d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384
-
Filesize
86KB
MD5147127382e001f495d1842ee7a9e7912
SHA192d1ed56032183c75d4b57d7ce30b1c4ae11dc9b
SHA256edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc
SHA51297f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d