Analysis
- max time kernel
131s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
30/09/2024, 16:10
General
- Target 02348c5f076396ffbf2becff5b678e68_JaffaCakes118.exe
- Size 1.0MB
- Sample240930-tmdb9ayape
- SHA256 39e47e936df55ba747669be113afa37d6af70be352d9668019c1dcfaea5f7495
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 34 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02348c5f076396ffbf2becff5b678e68_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02348c5f076396ffbf2becff5b678e68_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4328,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2548-0-0x0000000000E20000-0x0000000000E21000-memory.dmp
memory/2548-1-0x0000000000E30000-0x0000000000E31000-memory.dmp
memory/2548-2-0x0000000000E40000-0x0000000000E42000-memory.dmp
memory/2548-3-0x0000000000E50000-0x0000000000E52000-memory.dmp
memory/2548-4-0x0000000001110000-0x0000000001111000-memory.dmp
memory/2548-5-0x0000000001120000-0x0000000001121000-memory.dmp
memory/2548-7-0x0000000001140000-0x0000000001141000-memory.dmp
memory/2548-6-0x0000000001130000-0x0000000001131000-memory.dmp
memory/2548-8-0x0000000001150000-0x0000000001153000-memory.dmp
memory/2548-9-0x0000000001160000-0x0000000001162000-memory.dmp
memory/2548-11-0x0000000001180000-0x0000000001181000-memory.dmp
memory/2548-10-0x0000000001170000-0x0000000001171000-memory.dmp
memory/2548-12-0x0000000001190000-0x0000000001191000-memory.dmp
memory/2548-13-0x00000000011A0000-0x00000000011A1000-memory.dmp
memory/2548-14-0x00000000011B0000-0x00000000011B1000-memory.dmp
memory/2548-15-0x00000000011C0000-0x00000000011C1000-memory.dmp
memory/2548-16-0x00000000011D0000-0x00000000011D2000-memory.dmp
memory/2548-17-0x00000000011E0000-0x00000000011E2000-memory.dmp
memory/2548-18-0x00000000011F0000-0x00000000011F1000-memory.dmp
memory/2548-19-0x0000000001880000-0x0000000001881000-memory.dmp
memory/2548-22-0x0000000001920000-0x0000000001921000-memory.dmp
memory/2548-23-0x0000000001940000-0x0000000001941000-memory.dmp
memory/2548-24-0x0000000001950000-0x0000000001951000-memory.dmp
memory/2548-25-0x0000000001960000-0x0000000001961000-memory.dmp
memory/2548-26-0x0000000001970000-0x0000000001971000-memory.dmp
memory/2548-27-0x0000000001980000-0x0000000001981000-memory.dmp
memory/2548-28-0x0000000001990000-0x0000000001991000-memory.dmp
memory/2548-30-0x00000000019A0000-0x00000000019A2000-memory.dmp
memory/2548-29-0x0000000003B70000-0x0000000003CB1000-memory.dmp
memory/2548-37-0x0000000001890000-0x0000000001891000-memory.dmp
memory/2548-39-0x0000000075D60000-0x0000000075D61000-memory.dmp
memory/2548-38-0x00000000017E0000-0x00000000017E1000-memory.dmp
memory/2548-40-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-41-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-43-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-42-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-44-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-45-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-46-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-47-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-55-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-56-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-57-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-58-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-59-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-60-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-61-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-62-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-63-0x0000000075D40000-0x0000000075E30000-memory.dmp
memory/2548-64-0x0000000075D40000-0x0000000075E30000-memory.dmp