Overview

overview

6

Static

static

5

60b16a166a...18.exe

windows7-x64

6

60b16a166a...18.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2024, 05:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    60b16a166a8043bfccb1b1888ba035f6_JaffaCakes118.exe
  • Size 221KB
  • Sample241020-gnlnsssemd
  • SHA256 d789bda182c6d619039ceb29677921b454b1313f0fad6a65bf054f8d81111d38
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
discoveryupx

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60b16a166a8043bfccb1b1888ba035f6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\60b16a166a8043bfccb1b1888ba035f6_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4684
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1116
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4880
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4928 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2120
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3588 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3500
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:620
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1344 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2316
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4708 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4048

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        103621DE9CD5414CC2538780B4B75751
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
        • Size 717B
        • SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
        • MD5 SHA1 SHA512
        Submit Download

        81198C69971B71C1AD9EF3E1FE308A80
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81198C69971B71C1AD9EF3E1FE308A80
        • Size 504B
        • SHA256 7bbce0000266d04c3ba55c91033a68d65a1a9f5687287eead1b97bd7ac8bc8c1
        • MD5 SHA1 SHA512
        Submit Download

        103621DE9CD5414CC2538780B4B75751
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
        • Size 192B
        • SHA256 1bd27f605044167a1bbf9bbc2a797f448b0a03eb7e1f1d0214e03c4f8d39089b
        • MD5 SHA1 SHA512
        Submit Download

        81198C69971B71C1AD9EF3E1FE308A80
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81198C69971B71C1AD9EF3E1FE308A80
        • Size 546B
        • SHA256 0b44b27e7814f61620b1a383a8ba8f4789cc2438c3e0e8785b9a3abdce8cd925
        • MD5 SHA1 SHA512
        Submit Download

        checkin[3].json
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMGLWGAG\checkin[3].json
        • Size 35B
        • SHA256 cbcd722b2d561181f1fb42436cafb37d9b5224fc66fb495f999757cb0e6e74bb
        • MD5 SHA1 SHA512
        Submit Download

        salesform[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMGLWGAG\salesform[1].js
        • Size 1KB
        • SHA256 b2c8aae7f048166bd170691151405e052c75af6ac62629af5f37ce8a0d67a93c
        • MD5 SHA1 SHA512
        Submit Download

        jquery-1.10.2[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\jquery-1.10.2[1].js
        • Size 266KB
        • SHA256 8ade6740a1d3cfedf81e28d9250929341207b23a55f1be90ccc26cf6d98e052a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        jquery-ui[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\jquery-ui[1].js
        • Size 458KB
        • SHA256 d2f0522008bff05c6434e48ac8f11f7464331436a4d5d96a14a058a81a75c82e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select[1].css
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YY018DS9\select[1].css
        • Size 34KB
        • SHA256 b69a3b8e800a53d89a0d95d57cf4f2d1b8f8ed7c1396227e27500e21e4b02c51
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        service.min[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YY018DS9\service.min[1].js
        • Size 2KB
        • SHA256 682e6b028fb2bd0c2fde6faa842befcca91139c200226c28df777abb01185e2e
        • MD5 SHA1 SHA512
        Submit Download

        ~DFA6C9F4BD4817B7A8.TMP
        • Path C:\Users\Admin\AppData\Local\Temp\~DFA6C9F4BD4817B7A8.TMP
        • Size 16KB
        • SHA256 00bd0387702e676240d488bf6574f739930a6ea6e7bd3972388f094ffb46415f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/4684-0-0x0000000000400000-0x0000000000439000-memory.dmp
        Download

        memory/4684-25-0x0000000000400000-0x0000000000439000-memory.dmp
        Download