fb37d5ebfbd5880f210faccb781d3028bdc3f6e6210ed9ca30bc4c2992848709 | Triage

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 03:10 UTC

Sharing

Report Analysis Logs

General

Target

c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe
Size

2.0MB
MD5

c92963fb730d7ca1edc4e93557f47cf2
SHA1

325a03579a3447816923921f6fafb5c0ed4b2baf
SHA256

fb37d5ebfbd5880f210faccb781d3028bdc3f6e6210ed9ca30bc4c2992848709
SHA512

04c89744571f2a3436fa426c399824d6745af8ce566d876c44333f106f3d7694019a5161f7686d3d82bee406c6c4efd8b31248f3f0b52ad582b0b703b6e8aba7
SSDEEP

49152:OFUcx88PWPOpX0SF9sXebreu5FEBJ1YpPjeWtyGc:O+K88uPCHjsumZCjZyGc

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	1642.tmp

Executes dropped EXE 1 IoCs

pid	Process
1620	1642.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	1642.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4092	WINWORD.EXE
4092	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1620	1642.tmp

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4092	WINWORD.EXE
4092	WINWORD.EXE
4092	WINWORD.EXE
4092	WINWORD.EXE
4092	WINWORD.EXE
4092	WINWORD.EXE
4092	WINWORD.EXE
4092	WINWORD.EXE
4092	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1620	3304	c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe	92
PID 3304 wrote to memory of 1620	3304	c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe	92
PID 3304 wrote to memory of 1620	3304	c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe	92
PID 1620 wrote to memory of 4092	1620	1642.tmp	94
PID 1620 wrote to memory of 4092	1620	1642.tmp	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Users\Admin\AppData\Local\Temp\1642.tmp
  "C:\Users\Admin\AppData\Local\Temp\1642.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe 6A08E50129D6CD9BB2408BD70A4088D57CBBAFC94B844F35C9B27DE748B1BB96BF732F8B57DC780E511AA3D6EF8C5ED5ABB46DA146DC7C889AA9FFFDB03EEC27
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:1612

Network

DNS

149.220.183.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

149.220.183.52.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

75.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

75.159.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

18.89.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.89.109.52.in-addr.arpa

IN PTR

Response
DNS

92.16.208.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

92.16.208.104.in-addr.arpa

IN PTR

Response
DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

18.31.95.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.31.95.13.in-addr.arpa

IN PTR

Response
DNS

24.139.73.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

24.139.73.23.in-addr.arpa

IN PTR

Response

24.139.73.23.in-addr.arpa

IN PTR

a23-73-139-24deploystaticakamaitechnologiescom
DNS

43.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.229.111.52.in-addr.arpa

IN PTR

Response
DNS

3.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.173.189.20.in-addr.arpa

IN PTR

Response

13.107.253.67:443

46 B
40 B
1
1

8.8.8.8:53

149.220.183.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

149.220.183.52.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

75.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

75.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

18.89.109.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

18.89.109.52.in-addr.arpa
8.8.8.8:53

92.16.208.104.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

92.16.208.104.in-addr.arpa
8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

18.31.95.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

18.31.95.13.in-addr.arpa
8.8.8.8:53

24.139.73.23.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

24.139.73.23.in-addr.arpa
8.8.8.8:53

43.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

43.229.111.52.in-addr.arpa
8.8.8.8:53

3.173.189.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

3.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1642.tmp

Filesize
2.0MB

MD5
3fd6b33ea8980e53ed0e0d1429c7c5af

SHA1
95cc4a3f568fb0ec8591d0e26bbbdeef7a67e2a0

SHA256
ef0534696c2515613435afa964ad9984a1244e0a738a5dda9b032d02d9814b86

SHA512
4dd9bc255b65eaaba8bb0e310508f11ea24973dac27c54cb9ac8120e4a8d29651b06fa70e0ef698735aa1b179c13501e34ffa2d26094160c4d95919bbf04a576

Download Submit
C:\Users\Admin\AppData\Local\Temp\c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.docx

Filesize
19KB

MD5
4046ff080673cffac6529512b8d3bdbb

SHA1
d3cbc39065b7a55e995fa25397da2140bdac80c1

SHA256
f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680

SHA512
453f70730b7560e3d3e23ddfa0fe74e014753f8b34b45254c1c0cf5fec0546a2b8b109a4f9d096e91711b6d02cb383a7136c2cb7bd6600d0598acf7c90c25418

Download Submit
memory/1620-5-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/3304-0-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/4092-18-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4092-20-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4092-14-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4092-16-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4092-15-0x00007FFFB6D30000-0x00007FFFB6D40000-memory.dmp

Filesize
64KB

Download
memory/4092-13-0x00007FFFB6D30000-0x00007FFFB6D40000-memory.dmp

Filesize
64KB

Download
memory/4092-11-0x00007FFFB6D30000-0x00007FFFB6D40000-memory.dmp

Filesize
64KB

Download
memory/4092-17-0x00007FFFB6D30000-0x00007FFFB6D40000-memory.dmp

Filesize
64KB

Download
memory/4092-19-0x00007FFFB6D30000-0x00007FFFB6D40000-memory.dmp

Filesize
64KB

Download
memory/4092-12-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4092-21-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4092-22-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4092-23-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4092-24-0x00007FFFB4610000-0x00007FFFB4620000-memory.dmp

Filesize
64KB

Download
memory/4092-25-0x00007FFFB4610000-0x00007FFFB4620000-memory.dmp

Filesize
64KB

Download
memory/4092-38-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4092-39-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4092-40-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp

Filesize
2.0MB

Download