Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 22:53

General

  • Target

    8c4e06c88654b9b897dbc98683dccad8_JaffaCakes118.exe

  • Size

    172KB

  • MD5

    8c4e06c88654b9b897dbc98683dccad8

  • SHA1

    2e6448321540ee5343badf2b26ff7ea5d034ac88

  • SHA256

    43b539761c9b239b41de8d1733c6063c56e8d0ab4acca92cde78c7e60918c3e8

  • SHA512

    9389ade44eee0a07d12de2198c32ae6bd20f441073c975943400e99f317745e86fbe91aee6d5e5ac300db29f2204c08209abdcc81c6d9a352ceb120606860581

  • SSDEEP

    3072:B4yeuQWjFhluoKA+UvBrMvNsmMCoCPI69dSVDl1Yvxexw4KtpFSy:K0FkA+U1MvimYGI694xzYvxexwRDj

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c4e06c88654b9b897dbc98683dccad8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8c4e06c88654b9b897dbc98683dccad8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Users\Admin\AppData\Local\Temp\8c4e06c88654b9b897dbc98683dccad8_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8c4e06c88654b9b897dbc98683dccad8_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Users\Admin\AppData\Local\Temp\8c4e06c88654b9b897dbc98683dccad8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\8c4e06c88654b9b897dbc98683dccad8_JaffaCakes118.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4100
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4952
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:640
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:640 CREDAT:17410 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:1880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver1EBE.tmp

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WLXU5DI6\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\POSITION4DLLNAME.txt

    Filesize

    2KB

    MD5

    f4f080ce4282e3af4b59657db1ab5772

    SHA1

    7ce4ee2a77efcad5737fda41fdd73af05b19c83e

    SHA256

    f9555a05f7911e7bcdc67dd958845d619b9d5ba5fe01b3d91bcc7260b95f7989

    SHA512

    5213d339fa73e4d787030a5aae4e561c4714de4e797f5ec18875fadfe9e121b7f6df5461c997506884454a2715cfa248a40b4e2964fa89b186e837aa590220a8

  • memory/1792-0-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1792-7-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/4100-10-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4100-12-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4100-13-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4100-16-0x0000000000610000-0x000000000065E000-memory.dmp

    Filesize

    312KB

  • memory/4100-18-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4560-9-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/4560-8-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/4560-5-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB