eecb9216a3279b62d3c941349f273e18d090c80f1fcb58b9ec016ac9549334a0

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
Size 199KB
Sample240404-qc85dshc99
SHA256 eecb9216a3279b62d3c941349f273e18d090c80f1fcb58b9ec016ac9549334a0
MD5 b920cbeb716d82c4137564c496d96efa
SHA1 75f55f3f6950373a608d5e5e9275f11c924e6a4c
SHA512 3a5496e1bf38b0c7ab07158b0f8203cc07332a335ed96e79b6c44bb4c7c3ae4e0625238c68d1b6f760fbb6abc266cfafac49dd5fda4721ccfcdd0c97b9e78089
SSDEEP 3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8+h1thz/s:o68i3odBiTl2+TCU/41thzs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winhash_up.exez	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\winhash_up.exe	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\bugMAKER.bat	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\winhash_up.exez	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5104	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 5104	1548	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe	86
PID 1548 wrote to memory of 5104	1548	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe	86
PID 1548 wrote to memory of 5104	1548	b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b920cbeb716d82c4137564c496d96efa_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bugMAKER.bat

Path C:\Windows\bugMAKER.bat
Size 90B
SHA256 5bfe62e5fae46a430c95cf2a62d0922c5047f39755b34fc76f3a1421e4450f05
MD5 0480ab2b21b646f7e167acd4a16c9f2e
SHA1 35732bc3b672bf70b09f8958be0433397bcf20d5
SHA512 5c7913f931103a9825ec6757bd88cc48639819f2057f3b53e953aef10ec9c84230006c8843583a7ee0bd40283453a80ac0b25ebc276bb2853b1b40f94061394c
MD5 SHA1 SHA512

Submit Download

memory/1548-24-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads