Analysis

  • max time kernel
    133s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 22:09

General

  • Target

    b53c538003e3962b0135031476f1daec_JaffaCakes118.exe

  • Size

    64KB

  • MD5

    b53c538003e3962b0135031476f1daec

  • SHA1

    4a49e738a8d9d985c49c6956ad7f255ccc872163

  • SHA256

    37c2a11f9f302036e2e89f3f336bfba40a2edf4bb9d0de74854865b00567d1f2

  • SHA512

    9859426f5788438d08f3a6a3945222a065740075efd973784125752ee50aa08f729be5bf4b3235dee269057909bfbf1158cc716655325c00bd6f47f87b129dda

  • SSDEEP

    768:Bx0opJh5MdL74fsRO3qy40FsyOlYZwB4byBnKoeDg6TIiM1/+KDP2Ip/xl5GYove:BxfpF274fsU+0FsyOlYZIovRkGj2

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b53c538003e3962b0135031476f1daec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b53c538003e3962b0135031476f1daec_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Users\Admin\AppData\Local\Temp\b53c538003e3962b0135031476f1daec_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\b53c538003e3962b0135031476f1daec_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.szhaokan.cn/welcome.php?k=t%2FK9qMCtzqrG67buxuvF1Mbrt%2FK38sbrwK3awLfyxdTA1sCtwK3Iy7fyv%2BzArbbuxuu27sbrv%2BzG67fyxuvH672owNa9qMCtvajA1r2owK29qMCtxuvL48bry%2BPG68vjxuvG68bry%2BPG68Ctvai9qMbrwNbG67Civaiwor2ovajG68XUxuvArb2owK29qMbrxuuwosbrx%2BvG68frvajG68brxuvA1sCtwK3G67fyxuvG67buwK3H67fyvai38r2ot%2FLL48bryMvA1rfFwNa3xcCtt%2FLArbfFwNbOqsCttu7ArcXUwK3G67fywNbArbfFt%2FLG68Ctt8XArcCtt%2FK9qMDWzqrArcbrwK23xcCttu7A1rfFwK3Arbfyt%2FLArcirwK3F1MCtzqrArdrAwNa3xbfyy%2BPA1rfFxuu3xb2oyKvArcXUwK3OqsCt2sC9qMXUwK29qMbrtu7G68DWxuuwosbrsKLG67%2Fsxuu9qMbrv%2BzA1sCtt%2FLG68CtvajG67but%2FK38rfysKLA1sCtt%2FLArcCtsKK38sDWxuu27rCit8XArcXUwK2wosbrxdTA1sCtwK3F1Lfyy%2BPG67buxuvL48DWwK238sbrwK23xcCtwK238r2oxuu27g%3D%3D
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4832
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.go2000.cn/?1
        3⤵
        • Modifies Internet Explorer settings
        PID:1124

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    fb678ed578cc85c2788510c2d3272e4c

    SHA1

    b7ab05a280d5dd1635f5015fdad52bee5d55a086

    SHA256

    402f83b861999708fd0b815eaf687d9b438a5140d103c5f5561a55573daf89d4

    SHA512

    54f960e588a1fd311776233d2d0d42e9612d8e1e1d8715d9121edad25d5f1c1f9dec076768f95282df0412cc31ba6ec2b76543d01cdac663702a29ab4078f0e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    6589744ed608b325c5b5cc6d2d555086

    SHA1

    fd92705d09d15e4732828bf7456410651bf73208

    SHA256

    de0376f8efdd815fb145930f3b1f6be660b39ccfff5db20247712a731928cf40

    SHA512

    85c26a2f5675b0d0a2209c6f58b4d9f1b7c55b83b9a51f8aeec3b7e479ea0e46973f0042d719f1433dcb4fb0b6cfafb64d86850e6ae47e168ed40d1c6e163abd

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\uoyvico\imagestore.dat

    Filesize

    1KB

    MD5

    88a0ce9d03dd9090ccd38660cf227031

    SHA1

    be2b4ea9ce70a84a3788a822b52552836b630a79

    SHA256

    c62dc76239d33ecbc3a7211b087e3233597364e43a874af15381b496e1379d6c

    SHA512

    f543bd808f0453d8eb742fe55036a401907e9997bec474c1c2d6a90671ae08b6b179f3d98047eef8c1e973dba03bd1c17c9307bfc276e66190b0ff8fef7210f3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\D-8384-F-526[1].htm

    Filesize

    10B

    MD5

    809e5905d1ca55e5d481f3313b325cfe

    SHA1

    dfed281b8ed916fe9f33f1ea37bce31000a04441

    SHA256

    ac7f41639c3b12b1b7ccd9b4c7595fbca37e0bcb878708cd64f1bedbbdae7a79

    SHA512

    7cfd320771ff2f242c7093c9e2458006bec7774cc31a9b544f96a90c1f8cd9a0b0c6dd671331bea14902c69a9b0dfeb5bb3ddbfc143c741c33e9e314248e7fc7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\68XY2BI1\js[1].js

    Filesize

    308KB

    MD5

    cb6b8ded4b176ec2239e05d3da1c8057

    SHA1

    2805d225d9445a9757dc800446a77cfada31eb19

    SHA256

    b11a11b63df8cb175e284e0bb642e416109809d0e9cfc21d150a834b49171dcc

    SHA512

    6944bbfbe234174263d7265ccca9e056cecd95a914a41964570ddc12a58e154c71323ffecbb1ca9b231a88fbf8e370485e6e38a093c2ce3a8c2787aa6a46acaa

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\favicon[1].ico

    Filesize

    1KB

    MD5

    7ef1f0a0093460fe46bb691578c07c95

    SHA1

    2da3ffbbf4737ce4dae9488359de34034d1ebfbd

    SHA256

    4c62eef22174220b8655590a77b27957f3518b4c3b7352d0b64263b80e728f2c

    SHA512

    68da2c2f6f7a88ae364a4cf776d2c42e50150501ccf9b740a2247885fb21d1becbe9ee0ba61e965dd21d8ee01be2b364a29a7f9032fc6b5cdfb28cc6b42f4793

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F1EZZCYM\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • memory/4456-2-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4456-0-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4456-3-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB