Analysis

  • max time kernel
    94s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-07-2024 03:14

General

  • Target

    2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe

  • Size

    654KB

  • MD5

    2aca4c28536d8881ea6a357cf76050ee

  • SHA1

    85e18854fb7a7a4c5f1d7830014d50e1555c41f8

  • SHA256

    c3243905f89bfdacd8ece8dc8fa0d9e79e2522a9b6b3cea642eb64c70b507459

  • SHA512

    35e8d8a7b7eb4e202843888bd5b74bc09447627771c4175653c2e8f09fe422fdf85008de012f0bc29ed69d516ddd70cc5fd5b41895df9eca6daa76ca5347d96d

  • SSDEEP

    12288:waWzgMg7v3qnCiMErQohh0F4CCJ8lnyPQ/+:3aHMv6CorjqnyPQ/+

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2aca4c28536d8881ea6a357cf76050ee_JaffaCakes118.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.81830.info/tg15.html?2d
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3412
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3412 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1072
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3412 CREDAT:148482 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2736
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:4692
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4908
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4908 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2532

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5AB62DA2-3D11-11EF-9BD7-6E7C67FFD1A4}.dat

      Filesize

      3KB

      MD5

      1af591df9397a0aaa4cb92bfc2c8faad

      SHA1

      33be0fb514a8977db80605643cf6e813db73387a

      SHA256

      4c0036f0592b09c59e7e0eee8bc56c12de3808b648ba2ede66ab786e651c6de6

      SHA512

      68f591d4510feae7aca108d0bf755f3455e7095be696ca3ce249c6443eb642ecbfcdcf65bbc0e4673dfcf014214c29df5addeba80a9bc67f6a0ce6dfcae86c8b

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5AC6DEEB-3D11-11EF-9BD7-6E7C67FFD1A4}.dat

      Filesize

      5KB

      MD5

      14f02518c364b073863ead699fab486a

      SHA1

      26018053d7396289b95168c06ba281159a8c5a1a

      SHA256

      2bd5f0c25c7a7ab1396bda79f3bdbbfbab3a8e2eb39a547d19943dacb9025825

      SHA512

      0fdd63bb0799f542476e75f79b3ff1ee49d92518e4046840250a2f39886a15598b2738a255f2c4bbc99e6fd74c1474eeb291a02ea9535e3e2fd526ef816e4116

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verEEE4.tmp

      Filesize

      15KB

      MD5

      1a545d0052b581fbb2ab4c52133846bc

      SHA1

      62f3266a9b9925cd6d98658b92adec673cbe3dd3

      SHA256

      557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

      SHA512

      bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NMWT2DJF\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee