Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 03:59

General

  • Target

    48205917626ab5528a8ac3594f3bd7bb_JaffaCakes118.exe

  • Size

    675KB

  • MD5

    48205917626ab5528a8ac3594f3bd7bb

  • SHA1

    1b763ff56c7c87ee6489c1aabd588b570b16c0f1

  • SHA256

    4514b71f6a39716322763b578aac2fb88c1f8531dd3638e1819a504e6ba531a5

  • SHA512

    d1e9deaea0c04a7e81c893ab26f0f30127d636889dfa0c4995c519641a4a2e6e85291ebf186724d473bf4d16c1f60c8c49d25195f28606f5c646bcad3c87beae

  • SSDEEP

    12288:waWzgMg7v3qnCiMErQohh0F4CCJ8lnyPQUiOn:3aHMv6CorjqnyPQan

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48205917626ab5528a8ac3594f3bd7bb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\48205917626ab5528a8ac3594f3bd7bb_JaffaCakes118.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.9688.la/tg15.html?2d
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4824 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2012
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4824 CREDAT:148482 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1956
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:1404
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1488

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B401F43A-425E-11EF-AF84-7A4AC7ACABCB}.dat

      Filesize

      4KB

      MD5

      5d07ad4f73639384ca98c1d547439f73

      SHA1

      f248c513b801901fab2778d9d4ab0e973388c462

      SHA256

      0ea94853ee0943d9047628b7635affe904302eaa4b2b6780f46381e969e18c6a

      SHA512

      2536da5ea7aa03f6addf8bafb0e48519c679e3ef5928aaee1c59bd49b2326d68a26bb92ecd81eafaf3132c56cd37f01ee6b10eefbe28fdc59a35b482ee58ec1c

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B4104356-425E-11EF-AF84-7A4AC7ACABCB}.dat

      Filesize

      5KB

      MD5

      e7f63fbae073b8e85d40123d30769445

      SHA1

      9b4f7f13cc5825c4f288cd5173f007ff9a9c2286

      SHA256

      f3f822de3493777822c712f24f7fa871aa3feec431cd353c6d03f3b368fd8bc1

      SHA512

      7b1f39d60609c4e6e2c94a05dc66b5dfe2ba041508a106ee26877eeccc9387a110f6effdc965f22534b1ff35a833cccbce299d5b09fbc962af12f9a16239abba

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml

      Filesize

      15KB

      MD5

      1a545d0052b581fbb2ab4c52133846bc

      SHA1

      62f3266a9b9925cd6d98658b92adec673cbe3dd3

      SHA256

      557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

      SHA512

      bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QOWVUGSW\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee