Analysis
-
max time kernel
94s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe
-
Size
145KB
-
MD5
d727ddb21ba2a754ebfcd64053796ac6
-
SHA1
03f11470d827e11d0c1f3ac25f848282264b504d
-
SHA256
d772410f097f525acf0bc6b6d2008539ab4fe27bcc76200dc20b01219938544c
-
SHA512
1077cca7510aee9f07a9d09e048b8941cee231bf79826e12297d29c18454fc8ca17d47a8cc8f8e150560854b495bec204b90467c1b71210a4f4ccbac92415d9e
-
SSDEEP
3072:GIbejFUgrPc3pvbnzs27KMHwTpRCopnvvNQwin6/T6VtE6nD:7bwUgrk3BaMQTnBnvvy8T6VtXD
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1884 Qyquqk.exe 4220 Qyquqk.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qyquqk = "C:\\Users\\Admin\\AppData\\Roaming\\Qyquqk.exe" d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3724 set thread context of 1812 3724 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 82 PID 1884 set thread context of 4220 1884 Qyquqk.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qyquqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qyquqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4172446348" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4171820747" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4172446348" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4171820747" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31130370" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432683866" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31130370" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{239FA632-6EF6-11EF-818E-6ADB259EA846} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31130370" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31130370" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1812 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 1812 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4220 Qyquqk.exe Token: SeDebugPrivilege 4464 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3484 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3484 IEXPLORE.EXE 3484 IEXPLORE.EXE 4464 IEXPLORE.EXE 4464 IEXPLORE.EXE 4464 IEXPLORE.EXE 4464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3724 wrote to memory of 1812 3724 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 82 PID 3724 wrote to memory of 1812 3724 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 82 PID 3724 wrote to memory of 1812 3724 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 82 PID 3724 wrote to memory of 1812 3724 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 82 PID 3724 wrote to memory of 1812 3724 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 82 PID 3724 wrote to memory of 1812 3724 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 82 PID 3724 wrote to memory of 1812 3724 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 82 PID 3724 wrote to memory of 1812 3724 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 82 PID 1812 wrote to memory of 1884 1812 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 87 PID 1812 wrote to memory of 1884 1812 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 87 PID 1812 wrote to memory of 1884 1812 d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe 87 PID 1884 wrote to memory of 4220 1884 Qyquqk.exe 88 PID 1884 wrote to memory of 4220 1884 Qyquqk.exe 88 PID 1884 wrote to memory of 4220 1884 Qyquqk.exe 88 PID 1884 wrote to memory of 4220 1884 Qyquqk.exe 88 PID 1884 wrote to memory of 4220 1884 Qyquqk.exe 88 PID 1884 wrote to memory of 4220 1884 Qyquqk.exe 88 PID 1884 wrote to memory of 4220 1884 Qyquqk.exe 88 PID 1884 wrote to memory of 4220 1884 Qyquqk.exe 88 PID 4220 wrote to memory of 1900 4220 Qyquqk.exe 93 PID 4220 wrote to memory of 1900 4220 Qyquqk.exe 93 PID 4220 wrote to memory of 1900 4220 Qyquqk.exe 93 PID 1900 wrote to memory of 3484 1900 iexplore.exe 94 PID 1900 wrote to memory of 3484 1900 iexplore.exe 94 PID 3484 wrote to memory of 4464 3484 IEXPLORE.EXE 95 PID 3484 wrote to memory of 4464 3484 IEXPLORE.EXE 95 PID 3484 wrote to memory of 4464 3484 IEXPLORE.EXE 95 PID 4220 wrote to memory of 4464 4220 Qyquqk.exe 95 PID 4220 wrote to memory of 4464 4220 Qyquqk.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d727ddb21ba2a754ebfcd64053796ac6_JaffaCakes118.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Roaming\Qyquqk.exe"C:\Users\Admin\AppData\Roaming\Qyquqk.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Roaming\Qyquqk.exeC:\Users\Admin\AppData\Roaming\Qyquqk.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3484 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4464
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5aab286bb456859cae2f78a66a3dd795b
SHA116d32cdd9959586b11aacf682d6f8fd8a57eca8d
SHA25670e602cf187b74a4a8f0660a02aa57c79b326b5f70d14649a9259da01f34a4bf
SHA512de22ca238f407b029330978bfee646a8a9421befc5c570eddd7afb647b1ddc2a4ff5e14d6dd0dc03978b75b5252d508b7e62a02a15ebb528b547bf2a95c9b188
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5eaf6ff61574dbc144dc9b12ebbde58b2
SHA1c22f8edd76893b4511155e56dad1c4b594c6c8bb
SHA256dcbb512b9218598142266c29488192ed092b8863c8e7e6c4e70e203c3ce872cb
SHA512f222c7d15cc55a640a05d92a40ee6ec055abf3f53f90ecfd5961bbf907e53ffef2e23a1bb529d646f29d492955448176805ed8d7daa88c15fdc1bb6fbae7d0bd
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
145KB
MD5d727ddb21ba2a754ebfcd64053796ac6
SHA103f11470d827e11d0c1f3ac25f848282264b504d
SHA256d772410f097f525acf0bc6b6d2008539ab4fe27bcc76200dc20b01219938544c
SHA5121077cca7510aee9f07a9d09e048b8941cee231bf79826e12297d29c18454fc8ca17d47a8cc8f8e150560854b495bec204b90467c1b71210a4f4ccbac92415d9e