7de91ccae4901174028dd74cec32da9020636306ab72b78c37b661d05d53559d

Analysis

max time kernel
4s
max time network
10s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9e8ff4be7e6974a1a9858bc9e346ac2_JaffaCakes118.exe
Size

5.2MB
MD5

e9e8ff4be7e6974a1a9858bc9e346ac2
SHA1

aaebc39377f52f8dcece1bf864b163b0d5619c62
SHA256

7de91ccae4901174028dd74cec32da9020636306ab72b78c37b661d05d53559d
SHA512

c13395829b862644431afd9f33f25efaf34771243ef578feb05bb48dca11a9114d007d2f2a37ad1e1c0fcfedee1c4534ed0856d1b5bc95170a2d0672f16c4fd3
SSDEEP

98304:m2sR1SpiLe+T8NB2FUPNhigHh9mUu+a8IGGgxCGEvx5bLa8A:Ryd6NBCUNhigHbju+0RgVErLA

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	WIAC5D~1.EXE

Executes dropped EXE 2 IoCs

pid	Process
676	WIAC5D~1.EXE
4884	SC2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e9e8ff4be7e6974a1a9858bc9e346ac2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	676	WIAC5D~1.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 676	2452	e9e8ff4be7e6974a1a9858bc9e346ac2_JaffaCakes118.exe	94
PID 2452 wrote to memory of 676	2452	e9e8ff4be7e6974a1a9858bc9e346ac2_JaffaCakes118.exe	94
PID 2452 wrote to memory of 676	2452	e9e8ff4be7e6974a1a9858bc9e346ac2_JaffaCakes118.exe	94
PID 676 wrote to memory of 404	676	WIAC5D~1.EXE	97
PID 676 wrote to memory of 404	676	WIAC5D~1.EXE	97
PID 676 wrote to memory of 404	676	WIAC5D~1.EXE	97
PID 2452 wrote to memory of 4884	2452	e9e8ff4be7e6974a1a9858bc9e346ac2_JaffaCakes118.exe	99
PID 2452 wrote to memory of 4884	2452	e9e8ff4be7e6974a1a9858bc9e346ac2_JaffaCakes118.exe	99
PID 2452 wrote to memory of 4884	2452	e9e8ff4be7e6974a1a9858bc9e346ac2_JaffaCakes118.exe	99

C:\Users\Admin\AppData\Local\Temp\e9e8ff4be7e6974a1a9858bc9e346ac2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e9e8ff4be7e6974a1a9858bc9e346ac2_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WIAC5D~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WIAC5D~1.EXE
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WIAC5D~1.EXE > nul
    3⤵
    PID:404
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SC2.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SC2.exe
  2⤵
  - Executes dropped EXE
  PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SC2.exe

Filesize
7.8MB

MD5
f360297d66e1cac9a42f3147c5e0cb9f

SHA1
22f1b018124c8b4818aa425592b241705c2a1e21

SHA256
1c88ac8a32b9ab7877d939c679c0f42a9a5433c8809ecbffdbcb2c892a333b00

SHA512
365364b6594589c17a7f1e4a16b50a231f95031bda21f7a76eba636640796199c7da0e9007faf0c818648dbea62700c15b16d195ec0ea245e8c2762232c9be95

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SC2.exe

Filesize
6.4MB

MD5
a4bcee3eec3cdddc56d61333df26eff3

SHA1
dbfef43d20b79ac8aa77e1dceb774c7587fba7e7

SHA256
0852dfd6281883915ce9c6ca401915f7d62f1a99446b8588d5f4c676916dfa2e

SHA512
ac4de6d518e29052ecfb2501abaf7be3bf3c7c181c31a829c8151fb524afb0f0d0a42ed072f3cffbcfb11c4ec10133522d1a39385bca568941f2382b461b87c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WIAC5D~1.EXE

Filesize
22KB

MD5
fe324687431d76db88eeb0c7d0d195c0

SHA1
7bce847a9fda3d0202a86390be1346da52adbab8

SHA256
f9d18094c5a4bdec493c85efce1a389b95bbdfab994c2018c6254ab511a7b313

SHA512
1967d4411bc44b9b594e2633b717da8443ff8bb62abf514626bb4b017c4a4bd07bb03c6b760753c5205a3fd4ff2566a45f150f8b5b7c605d461652dbc146b730

Download Submit
memory/676-7-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/676-8-0x0000000000530000-0x0000000000533000-memory.dmp

Filesize
12KB

Download
memory/676-9-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads