ad4c07c455348f22fa282080454dbce00133d4f2aaf11605e132a2a6bf7ec7e5

Analysis

max time kernel
126s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe
Size

428KB
MD5

ff8770b20777545c9e03bb7532e5771c
SHA1

d641452c62f1262f769a40602d3182b26b48ed85
SHA256

ad4c07c455348f22fa282080454dbce00133d4f2aaf11605e132a2a6bf7ec7e5
SHA512

b8fbecbb856e35b1a09b1aab1f902490677f5a66d04c07c88bd3955961c5b1b1aae8b45da8a4f8825b193b575d34d127e1b7d870e95218e9b0805898fb7970f5
SSDEEP

12288:pu6/DdQHroPTAwpwXQsBPTeoG0HhDtdC2Cp4JSErXD+Kz4:pl7WsPkA8QsBPyoG0HBrC2zJSKD+

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
3672	verclsid.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\setup.exe:Zone.Identifier	ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	verclsid.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\setup.exe:Zone.Identifier	ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\x3bxj8ey.gif:Zone.Identifier	ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
740	ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 3672	740	ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe	89
PID 740 wrote to memory of 3672	740	ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe	89
PID 740 wrote to memory of 3672	740	ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff8770b20777545c9e03bb7532e5771c_JaffaCakes118.exe"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\verclsid.exe
  "C:\Windows\system32\verclsid.exe" /S /C {25336920-03F9-11CF-8FD0-00AA00686F13} /I {00000112-0000-0000-C000-000000000046} /X 0x5
  2⤵
  - System Binary Proxy Execution: Verclsid
  - System Location Discovery: System Language Discovery
  PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x3bxj8ey.gif

Filesize
55KB

MD5
d2992e9ac1afd60e7d81134ad77e1116

SHA1
065f272d630d4af67e0c8d8db657c257a848dd81

SHA256
3c4eb8a1747a819bbd26f14273d3022603b8c66b2650fe1be6b67e03a8bbfc5f

SHA512
08a67bbf62144519eff40816e1e4dd281a0fd7cce3a168d0311f7b9930fce6337edc458e26240911bcc41c0646f4e11d154faee6863203e73ea7eff58aa86ea0

Download Submit