24d866899b9990e8753ceff427d21886579b8da3bf67378af52ca562edb5b7d1

Analysis

max time kernel
92s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
Size 214KB
Sample240404-q5mrvsab72
SHA256 24d866899b9990e8753ceff427d21886579b8da3bf67378af52ca562edb5b7d1
MD5 ba0730421112c4644d756c4aa66f1e82
SHA1 2150ad69ebd1ed87ba63afddd52c8a35e3219ad5
SHA512 51177e710551884521fd019e183634d609eb1f8d1c25469f986b8140abf7924f08f1fa80a02f9a78b014ec61377cf0b6c7aeb25a3d39c491be800639c05b8040
SSDEEP 3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8WpjBFy11AwG:o68i3odBiTl2+TCU/JhuhuIpY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winhash_up.exez	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\bugMAKER.bat	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\winhash_up.exez	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
File created	C:\Windows\winhash_up.exe	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3340	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3340	2652	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe	86
PID 2652 wrote to memory of 3340	2652	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe	86
PID 2652 wrote to memory of 3340	2652	ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ba0730421112c4644d756c4aa66f1e82_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bugMAKER.bat

Path C:\Windows\bugMAKER.bat
Size 90B
SHA256 143bb1708488e651250f08acce04be23dc6f4aef46e338c44d4e5cb2dd8aecbc
MD5 e106e55eec3740880718a1652f4eddf7
SHA1 4124f7716b384d8c5a8f0ee0236adadda79324c8
SHA512 3b4288dabaaf733ff3eb1228317c81a6a500f55c3d0fa32dba9bde4f195e9da114255a44b68bc897fe3c45feb87758e321b95ca73b3332fb4b4caf71b1927ba7
MD5 SHA1 SHA512

Submit Download

memory/2652-24-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads