Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 10:59

General

  • Target

    a68530dab223f080e594eed06ecefc44_JaffaCakes118.dll

  • Size

    195KB

  • MD5

    a68530dab223f080e594eed06ecefc44

  • SHA1

    583357a707980ea5f6c1707c582e6f7256206103

  • SHA256

    4b6e2186514f55d30155139b381c8d4010be229a9cb2ffa03d1d7798649121d8

  • SHA512

    e7c35415bb9f22c8dc3ddfc75046c5d18c6b2a82a045ada35f7084924629f29efd8df550a9c0f5bf63ab7e6f9b71dc57e391108da33c6513b24176b95745c112

  • SSDEEP

    3072:KqLZ0EabcgO8JqJOuj3Yy+d1Amg6kbF85pGCDz7EQtVx1Phij8+WeH87Ywl:xqEabD0JOMKd1moJhkjZPy

Score
8/10

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 45 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\a68530dab223f080e594eed06ecefc44_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\a68530dab223f080e594eed06ecefc44_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer Protected Mode
      • Modifies Internet Explorer Protected Mode Banner
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:656
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:920
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        PID:1028
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        PID:3848
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1188
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
    1⤵
      PID:3172
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1992
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3568
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3568 CREDAT:17410 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3396

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            471B

            MD5

            5807ccf18a4daa262942fd318d06027d

            SHA1

            dbc8a19819ea0e72bb69aea4e08b5c08b19cebe9

            SHA256

            49127429f1b3e1e3126358abbce54b463587489939f48256edc3f4f54dc10890

            SHA512

            204d2d8ff7d0b847b6263f9759441c88c32d39fca326de017c1c1e2bb33d64455adfcde5e96705f5408361a3a34baf002aaff12645413e5ec3bb13b2d7e980ad

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            404B

            MD5

            019e6402d500d38e035d50da2b3b837b

            SHA1

            5659ce1155622a02805da12179107b3c44f44661

            SHA256

            f39cac4236620b2b13441ba89b7ee6cd2bea019379b7cad06e165cc22ddf1971

            SHA512

            5616a7a4b1d7f34421f19fd7d0ae2ea7ea04704811d731ce331122ab3bd714adcb4cf1a8cdbd806850a727c88c61ca62828a1b65cb8ab8fac050d5db4749bf1a

          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver602C.tmp

            Filesize

            15KB

            MD5

            1a545d0052b581fbb2ab4c52133846bc

            SHA1

            62f3266a9b9925cd6d98658b92adec673cbe3dd3

            SHA256

            557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

            SHA512

            bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KDOTUZKP\suggestions[1].en-US

            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          • memory/656-0-0x00000000011C0000-0x00000000011F1000-memory.dmp

            Filesize

            196KB

          • memory/656-2-0x0000000002A50000-0x0000000002A81000-memory.dmp

            Filesize

            196KB

          • memory/656-1-0x0000000001200000-0x0000000001236000-memory.dmp

            Filesize

            216KB

          • memory/656-6-0x0000000001200000-0x0000000001236000-memory.dmp

            Filesize

            216KB

          • memory/656-9-0x0000000002A50000-0x0000000002A81000-memory.dmp

            Filesize

            196KB

          • memory/656-10-0x0000000002A50000-0x0000000002A81000-memory.dmp

            Filesize

            196KB

          • memory/1028-4-0x0000000004850000-0x0000000004881000-memory.dmp

            Filesize

            196KB

          • memory/1028-8-0x0000000004850000-0x0000000004881000-memory.dmp

            Filesize

            196KB

          • memory/1028-7-0x0000000004850000-0x0000000004881000-memory.dmp

            Filesize

            196KB

          • memory/1028-5-0x0000000004850000-0x0000000004881000-memory.dmp

            Filesize

            196KB