Analysis
-
max time kernel
134s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 06:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
-
Target
2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe
-
Size
48KB
-
MD5
2b5a2e907c537cb715ecfd5f5c04066a
-
SHA1
ae8314df4cd454896a61127bcef61b43165dab21
-
SHA256
96c39166f9fba49bf6b56f3620deadc2a884c24291f3edeee8b938dc975fe78d
-
SHA512
4478a3a651b28655dccaee389ff05d94176f63459e9c458e91ceb51670d2542cfbd44301e24243bd0fda84e7568c501f4f90b4f7f7ad71c2ebd24fa18db88c5c
-
SSDEEP
768:/jUyRzVmldlJb85sz2HUWHmbh/dUPCf4PJm8eLH6Y1azw3cqjoepceJokDbGQ2QW:7UyRsJY5szAUTkFz/w3cqjoepskDv2y
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "no" 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Play_Animations = "no" 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Videos = "no" 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Enable AutoImageResize = "no" 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes" 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2292 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2292 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2292 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2292 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2292 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2292 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2292 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2260 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2260 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2260 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2260 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2260 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2260 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2260 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2108 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 32 PID 2088 wrote to memory of 2108 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 32 PID 2088 wrote to memory of 2108 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 32 PID 2088 wrote to memory of 2108 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 32 PID 2088 wrote to memory of 2108 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 32 PID 2088 wrote to memory of 2108 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 32 PID 2088 wrote to memory of 2108 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 32 PID 2088 wrote to memory of 1744 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 33 PID 2088 wrote to memory of 1744 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 33 PID 2088 wrote to memory of 1744 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 33 PID 2088 wrote to memory of 1744 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 33 PID 2088 wrote to memory of 1744 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 33 PID 2088 wrote to memory of 1744 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 33 PID 2088 wrote to memory of 1744 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 33 PID 2088 wrote to memory of 1092 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 34 PID 2088 wrote to memory of 1092 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 34 PID 2088 wrote to memory of 1092 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 34 PID 2088 wrote to memory of 1092 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 34 PID 2088 wrote to memory of 1092 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 34 PID 2088 wrote to memory of 1092 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 34 PID 2088 wrote to memory of 1092 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 34 PID 2088 wrote to memory of 1080 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 35 PID 2088 wrote to memory of 1080 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 35 PID 2088 wrote to memory of 1080 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 35 PID 2088 wrote to memory of 1080 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 35 PID 2088 wrote to memory of 1080 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 35 PID 2088 wrote to memory of 1080 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 35 PID 2088 wrote to memory of 1080 2088 2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2b5a2e907c537cb715ecfd5f5c04066a_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /u /s wmp.dll2⤵PID:2292
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /u /s shimgvw.dll2⤵PID:2260
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /u /s itss.dll2⤵PID:2108
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /u /s scrrun.dll2⤵PID:1744
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /u /s vbscript.dll2⤵PID:1092
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s jscript.dll2⤵PID:1080
-