ddaae5ce6dd6146248dc54d04599a6b0c57d9a4513feb2488b206801de8f2b57

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43f1493ae2616ee8337c57b1c5b0fc0b_JaffaCakes118.exe
Size

239KB
MD5

43f1493ae2616ee8337c57b1c5b0fc0b
SHA1

3a0b5c1c4a9272c2c3fe7e97675bac4affbadba4
SHA256

ddaae5ce6dd6146248dc54d04599a6b0c57d9a4513feb2488b206801de8f2b57
SHA512

21f1bf7b9f151150d5c02d95e58feaa6d395c941f3b181b33d8f1ad1ce891a1ced2de3af58e6ec4b774e1af26f9aa9181171721b4388a3a55f93f8411dc2949f
SSDEEP

6144:ybPTZPIBXnMZjS4ad2003WNQiYomG5RIxCdW9M6H0:y1IBXyS4a400GNFYomGjWv

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2340	oaPB769.exe

Loads dropped DLL 1 IoCs

pid	Process
2340	oaPB769.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSSMSGS = "rundll32.exe winjvh32.rom,QhmnGMYponI"	oaPB769.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winjvh32.rom	oaPB769.exe
File opened for modification	C:\Windows\SysWOW64\winjvh32.rom	oaPB769.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1340	2340	WerFault.exe	84
3896	3448	WerFault.exe	82

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31118742"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427689299"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{41B3F716-4189-11EF-AF84-7A4AC7ACABCB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31118742"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "374626752"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31118742"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "371345120"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "371345120"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5004	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5004	iexplore.exe
5004	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 2340	3448	43f1493ae2616ee8337c57b1c5b0fc0b_JaffaCakes118.exe	84
PID 3448 wrote to memory of 2340	3448	43f1493ae2616ee8337c57b1c5b0fc0b_JaffaCakes118.exe	84
PID 3448 wrote to memory of 2340	3448	43f1493ae2616ee8337c57b1c5b0fc0b_JaffaCakes118.exe	84
PID 2340 wrote to memory of 3048	2340	oaPB769.exe	87
PID 2340 wrote to memory of 3048	2340	oaPB769.exe	87
PID 2340 wrote to memory of 3048	2340	oaPB769.exe	87
PID 3048 wrote to memory of 5004	3048	cmd.exe	89
PID 3048 wrote to memory of 5004	3048	cmd.exe	89
PID 5004 wrote to memory of 2912	5004	iexplore.exe	91
PID 5004 wrote to memory of 2912	5004	iexplore.exe	91
PID 5004 wrote to memory of 2912	5004	iexplore.exe	91
PID 2340 wrote to memory of 5004	2340	oaPB769.exe	89
PID 2340 wrote to memory of 5004	2340	oaPB769.exe	89
PID 2340 wrote to memory of 2552	2340	oaPB769.exe	92
PID 2340 wrote to memory of 2552	2340	oaPB769.exe	92
PID 2340 wrote to memory of 2552	2340	oaPB769.exe	92

C:\Users\Admin\AppData\Local\Temp\43f1493ae2616ee8337c57b1c5b0fc0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43f1493ae2616ee8337c57b1c5b0fc0b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\oaPB769.exe
  "C:\Users\Admin\AppData\Local\Temp\oaPB769.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c start iexplore -embedding
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -embedding
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5004 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BhuB7D6.bat"
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 464
    3⤵
    - Program crash
    PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 312
  2⤵
  - Program crash
  PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2340 -ip 2340
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3448 -ip 3448
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QOWVUGSW\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\BhuB7D6.bat

Filesize
188B

MD5
05ed5ee5d07ffeadb4100d9f552ada1d

SHA1
717ed3d3c59bc99988dfba1735110c3717a876a4

SHA256
bffe49f01a5e20be32494980d8d03f9016a232d7d902b1efc0c3cc8a92144418

SHA512
04960b0045171c94e83cacc55fc82e770ddf40bfe460f9c9b60d69f1b13316d1a1b114336282061f7ec26130dab6ba6a24a261c8291dbd31c4e6de88299e11dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\BhuB7D6.tmp

Filesize
106KB

MD5
c43f0e31674e0f4c88218c38b7d81ee7

SHA1
db6312950ee3c1f79bc96bf724aa2185b66a2a73

SHA256
7523ea71f532bed48c38938fcb494ccd76d0f2c36db06c7f4811b9d27b4e9a77

SHA512
9ea51359fc3e64da5eef9bf3c348040d4afb6a4b878cd08aad7ea0595216c15a27b8d3307e6ec575fdec206550cc058050f312c7722be47f6cd1f2f8a5a855e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\oaPB769.exe

Filesize
171KB

MD5
643aa304b3795c8af46bd189ec5746ae

SHA1
a39e2ae7bf09316b47ef00c251fce1731e67cdc5

SHA256
7a74bb0f96cc0e905b3b6f85bae405ffcde40b53f247e339f1a3f152f65106ad

SHA512
6d391791c187ffa542c5b287f2d1cab6ff5652e97031507baa865c6521787ab93207ecf827764f93b90cddb165975b08ce43bd1cc26f393a80a83327552b32c7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads