93d16173d58177d6018e2e16a410020761b7971c4ee5568884a9cc9b3604ce05

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
Size

223KB
MD5

ea30896c85ed5328d3e47d67b8762c6d
SHA1

f416d34578af416a3391365bd61966ed085b8eb9
SHA256

93d16173d58177d6018e2e16a410020761b7971c4ee5568884a9cc9b3604ce05
SHA512

25e0114d5e0874a7ac524db1f9f902f386c6efda3c34797e189afb0069dd3b5164831afa011870f7d0b870129dfb7fe8749539ffa4422b84e2010b7b12beba15
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8/pjBFycpjBG:o68i3odBiTl2+TCU/jzhuhuIpR

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SHARE_TEMP\Icon2.ico	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File created	C:\Windows\bugMAKER.bat	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File opened for modification	C:\Windows\winhash_up.exez	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File created	C:\Windows\winhash_up.exe	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
File created	C:\Windows\winhash_up.exez	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4488	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 4488	3044	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe	85
PID 3044 wrote to memory of 4488	3044	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe	85
PID 3044 wrote to memory of 4488	3044	ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea30896c85ed5328d3e47d67b8762c6d_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
90B

MD5
938d28944957bb8c255d64eee2a723b9

SHA1
1dc520d5f8cd786dc7a16589d1a53cb07cde3c16

SHA256
0b74a62ecac3830130baa14d33875fb10ff90339ab270af73517ff319f806d32

SHA512
1826c61c68c90bf8bee98bc3cb2315f78b4041a35d5034f0061dc856e0c6ea4b94ee1c1e8fc15d1c7c42d49dfac2388cf38f6d3506c1df32ee08b152857a1d62

Download Submit
memory/3044-24-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads