Analysis
-
max time kernel
94s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 09:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2bc543b0fa344fa8bd433c8b81362d0a_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2bc543b0fa344fa8bd433c8b81362d0a_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2bc543b0fa344fa8bd433c8b81362d0a_JaffaCakes118.exe
-
Size
29KB
-
MD5
2bc543b0fa344fa8bd433c8b81362d0a
-
SHA1
9d414c258c13e7c79d54db721f2270cae95656e4
-
SHA256
b0c02b685231e1047aca710b6dc8af7552d8fb8bb78a1c00203fd4b815296454
-
SHA512
684b60b9b57bd70248facf88b860e7fdd9df93317638b80e999851fa53259f7c22a23721b6c9e5e02abe380506f9992d092a553beee2a81a715b22ac0f27c106
-
SSDEEP
768:Xi8hO4Umjdb9dPEOtAGo4lnZDJnm4cX91/5bDlg0aKb30CWIOCbV7T:y844UcB9EOtAGo4lnZ1nm4cX91/9qKbP
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\program files (x86)\\adobe\\acrotray.exe" 2bc543b0fa344fa8bd433c8b81362d0a_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created \??\c:\program files (x86)\adobe\acrotray.exe 2bc543b0fa344fa8bd433c8b81362d0a_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400125654ad1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A1674435-3D3D-11EF-A2B8-6E7C67FFD1A4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1975837370" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209666814ad1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cb2fc91f87190e4194d42416469b424e000000000200000000001066000000010000200000002d587daf505c1ec1d88c5c17fb628fb260451a9ff73cd98fb2dd90d4933a5ba2000000000e8000000002000020000000bcb91e3ff24373c7644f298241417081b1e3c0ad2faaf7f374e13ee66a81a730200000000bd2c35136b69351b6c8cc06d5740fd03be5c571844d003668e0a78f9dff873840000000692dadf96b9d452e967c0cee5429729ed7269488f5df7cbedd6b7f62d7261be0855880200579ed6b2a45a5910aad227a9d2e8732ec6881fad7eb5982018881c7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1975837370" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a33b714ad1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cb2fc91f87190e4194d42416469b424e00000000020000000000106600000001000020000000f872fde507a35d0bb651fdc2075f1be6bac516cb2fa274f2e7b63b102707f376000000000e80000000020000200000001e9365d2bb10078538c94eabb29a10d7adb00b91214ace269e9d7caa290c5504200000002c7b708c6167aa56ead52f762c65a15a7952b66a68934da711ab04dff472ee18400000009acef0aba5ea9d0fbee8edb54284780c7081152206242d47cefeee71027c551077fe59ac5a984b0b2f5e8b0dbd4b6f11a621d185502bbe586ffd791ce723cf37 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31117642" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cb2fc91f87190e4194d42416469b424e00000000020000000000106600000001000020000000599f260f2422e31d84d2020f00f7b7909908828ecb16603614bf8344353b214b000000000e8000000002000020000000ea064ed3d472d8b566519e6205630d6bc5b5c437b2dcc8092e1210440f20393e20000000270a02a137b97213c9911ed4fe8cbe4fdb0335901cdaf3468307cc3ccd59ea414000000026d193c74333b1dc83ea15b38767c230a8dc413cd98de76d82e4bf9674bac5212e5df8a633561dc41713a0aa5a35a1404d50907eb332711cad1f979fc71c3315 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31117642" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2300 2bc543b0fa344fa8bd433c8b81362d0a_JaffaCakes118.exe 2300 2bc543b0fa344fa8bd433c8b81362d0a_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2280 iexplore.exe 2280 iexplore.exe 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2280 iexplore.exe 2280 iexplore.exe 3800 IEXPLORE.EXE 3800 IEXPLORE.EXE 2280 iexplore.exe 2280 iexplore.exe 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE 2280 iexplore.exe 2280 iexplore.exe 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2280 wrote to memory of 3800 2280 iexplore.exe 87 PID 2280 wrote to memory of 3800 2280 iexplore.exe 87 PID 2280 wrote to memory of 3800 2280 iexplore.exe 87 PID 2280 wrote to memory of 1700 2280 iexplore.exe 88 PID 2280 wrote to memory of 1700 2280 iexplore.exe 88 PID 2280 wrote to memory of 1700 2280 iexplore.exe 88 PID 2280 wrote to memory of 2360 2280 iexplore.exe 92 PID 2280 wrote to memory of 2360 2280 iexplore.exe 92 PID 2280 wrote to memory of 2360 2280 iexplore.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bc543b0fa344fa8bd433c8b81362d0a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2bc543b0fa344fa8bd433c8b81362d0a_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2300
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:1584
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3800
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:17420 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1700
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:17424 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2360
-