313ecfc83dfd696344b0492c40c106b7ee33d06f3dfdac17200864e8214cb5bb

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

165aa905981301839ab3707a6aff8103_JaffaCakes118.exe
Size

459KB
MD5

165aa905981301839ab3707a6aff8103
SHA1

2e998404e149b9f7a652ecd0ddb9ace7a787f7b8
SHA256

313ecfc83dfd696344b0492c40c106b7ee33d06f3dfdac17200864e8214cb5bb
SHA512

49728df28a5d0d87414835e8d197ba36254834a61f21d53af9377cbf36db9c1574541b29d772bfbd0c435753ff30ee29e195fe34fc9445422d5e91a85d77f9f4
SSDEEP

6144:ZE500zV6Lfl+RQmsaGSHHdivSHwm5CZq2AnK+LDqf7Q/ZRk0LLzQ8AJYk:C5jkrwPlGM9ivSHv52+qDQDzRk

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

dw20.exe

description	pid	process
Token: SeRestorePrivilege	488	dw20.exe
Token: SeBackupPrivilege	488	dw20.exe
Token: SeBackupPrivilege	488	dw20.exe
Token: SeBackupPrivilege	488	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

165aa905981301839ab3707a6aff8103_JaffaCakes118.exe

description	pid	process	target process
PID 4556 wrote to memory of 488	4556	165aa905981301839ab3707a6aff8103_JaffaCakes118.exe	dw20.exe
PID 4556 wrote to memory of 488	4556	165aa905981301839ab3707a6aff8103_JaffaCakes118.exe	dw20.exe
PID 4556 wrote to memory of 488	4556	165aa905981301839ab3707a6aff8103_JaffaCakes118.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\165aa905981301839ab3707a6aff8103_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\165aa905981301839ab3707a6aff8103_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4556

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1028
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:488

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4556-0-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/4556-1-0x0000000000650000-0x0000000000660000-memory.dmp

Filesize
64KB

Download
memory/4556-2-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/4556-9-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download