df82eb852e747c09c4f345ef2726bd4b0f1f262be3a2527401250ff9597343fe

Analysis

max time kernel
58s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

041b79a3c1c08bf01f4dc2aab6099c6c_JaffaCakes118.exe
Size

606KB
MD5

041b79a3c1c08bf01f4dc2aab6099c6c
SHA1

86dca132b50bbd9aab9995172f1b993b72098f51
SHA256

df82eb852e747c09c4f345ef2726bd4b0f1f262be3a2527401250ff9597343fe
SHA512

4b4c33dc8d3a782c83d17ecc4ddafc31652a3e6926dc805dc37287cf10fc0090df4a95b4b5ce1e9c54dc0e824fae719194a8b35ee8ac10ee191ca2770ebcd7ba
SSDEEP

12288:BE8AJKp5g33X2nwRNmXMU0fj6or3RXqBxAMUQ6TcRbp2uQ1q:BE/JKvg3WwRNeAfj6upqBx5U2RN2uL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	041b79a3c1c08bf01f4dc2aab6099c6c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
5076	cjcabfebba.exe

Loads dropped DLL 3 IoCs

pid	Process
1900	041b79a3c1c08bf01f4dc2aab6099c6c_JaffaCakes118.exe
1900	041b79a3c1c08bf01f4dc2aab6099c6c_JaffaCakes118.exe
1900	041b79a3c1c08bf01f4dc2aab6099c6c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	5076	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2340	wmic.exe
Token: SeSecurityPrivilege	2340	wmic.exe
Token: SeTakeOwnershipPrivilege	2340	wmic.exe
Token: SeLoadDriverPrivilege	2340	wmic.exe
Token: SeSystemProfilePrivilege	2340	wmic.exe
Token: SeSystemtimePrivilege	2340	wmic.exe
Token: SeProfSingleProcessPrivilege	2340	wmic.exe
Token: SeIncBasePriorityPrivilege	2340	wmic.exe
Token: SeCreatePagefilePrivilege	2340	wmic.exe
Token: SeBackupPrivilege	2340	wmic.exe
Token: SeRestorePrivilege	2340	wmic.exe
Token: SeShutdownPrivilege	2340	wmic.exe
Token: SeDebugPrivilege	2340	wmic.exe
Token: SeSystemEnvironmentPrivilege	2340	wmic.exe
Token: SeRemoteShutdownPrivilege	2340	wmic.exe
Token: SeUndockPrivilege	2340	wmic.exe
Token: SeManageVolumePrivilege	2340	wmic.exe
Token: 33	2340	wmic.exe
Token: 34	2340	wmic.exe
Token: 35	2340	wmic.exe
Token: 36	2340	wmic.exe
Token: SeIncreaseQuotaPrivilege	2340	wmic.exe
Token: SeSecurityPrivilege	2340	wmic.exe
Token: SeTakeOwnershipPrivilege	2340	wmic.exe
Token: SeLoadDriverPrivilege	2340	wmic.exe
Token: SeSystemProfilePrivilege	2340	wmic.exe
Token: SeSystemtimePrivilege	2340	wmic.exe
Token: SeProfSingleProcessPrivilege	2340	wmic.exe
Token: SeIncBasePriorityPrivilege	2340	wmic.exe
Token: SeCreatePagefilePrivilege	2340	wmic.exe
Token: SeBackupPrivilege	2340	wmic.exe
Token: SeRestorePrivilege	2340	wmic.exe
Token: SeShutdownPrivilege	2340	wmic.exe
Token: SeDebugPrivilege	2340	wmic.exe
Token: SeSystemEnvironmentPrivilege	2340	wmic.exe
Token: SeRemoteShutdownPrivilege	2340	wmic.exe
Token: SeUndockPrivilege	2340	wmic.exe
Token: SeManageVolumePrivilege	2340	wmic.exe
Token: 33	2340	wmic.exe
Token: 34	2340	wmic.exe
Token: 35	2340	wmic.exe
Token: 36	2340	wmic.exe
Token: SeIncreaseQuotaPrivilege	844	wmic.exe
Token: SeSecurityPrivilege	844	wmic.exe
Token: SeTakeOwnershipPrivilege	844	wmic.exe
Token: SeLoadDriverPrivilege	844	wmic.exe
Token: SeSystemProfilePrivilege	844	wmic.exe
Token: SeSystemtimePrivilege	844	wmic.exe
Token: SeProfSingleProcessPrivilege	844	wmic.exe
Token: SeIncBasePriorityPrivilege	844	wmic.exe
Token: SeCreatePagefilePrivilege	844	wmic.exe
Token: SeBackupPrivilege	844	wmic.exe
Token: SeRestorePrivilege	844	wmic.exe
Token: SeShutdownPrivilege	844	wmic.exe
Token: SeDebugPrivilege	844	wmic.exe
Token: SeSystemEnvironmentPrivilege	844	wmic.exe
Token: SeRemoteShutdownPrivilege	844	wmic.exe
Token: SeUndockPrivilege	844	wmic.exe
Token: SeManageVolumePrivilege	844	wmic.exe
Token: 33	844	wmic.exe
Token: 34	844	wmic.exe
Token: 35	844	wmic.exe
Token: 36	844	wmic.exe
Token: SeIncreaseQuotaPrivilege	844	wmic.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 5076	1900	041b79a3c1c08bf01f4dc2aab6099c6c_JaffaCakes118.exe	85
PID 1900 wrote to memory of 5076	1900	041b79a3c1c08bf01f4dc2aab6099c6c_JaffaCakes118.exe	85
PID 1900 wrote to memory of 5076	1900	041b79a3c1c08bf01f4dc2aab6099c6c_JaffaCakes118.exe	85
PID 5076 wrote to memory of 2340	5076	cjcabfebba.exe	86
PID 5076 wrote to memory of 2340	5076	cjcabfebba.exe	86
PID 5076 wrote to memory of 2340	5076	cjcabfebba.exe	86
PID 5076 wrote to memory of 844	5076	cjcabfebba.exe	89
PID 5076 wrote to memory of 844	5076	cjcabfebba.exe	89
PID 5076 wrote to memory of 844	5076	cjcabfebba.exe	89
PID 5076 wrote to memory of 4184	5076	cjcabfebba.exe	91
PID 5076 wrote to memory of 4184	5076	cjcabfebba.exe	91
PID 5076 wrote to memory of 4184	5076	cjcabfebba.exe	91
PID 5076 wrote to memory of 3580	5076	cjcabfebba.exe	94
PID 5076 wrote to memory of 3580	5076	cjcabfebba.exe	94
PID 5076 wrote to memory of 3580	5076	cjcabfebba.exe	94
PID 5076 wrote to memory of 3264	5076	cjcabfebba.exe	97
PID 5076 wrote to memory of 3264	5076	cjcabfebba.exe	97
PID 5076 wrote to memory of 3264	5076	cjcabfebba.exe	97

C:\Users\Admin\AppData\Local\Temp\041b79a3c1c08bf01f4dc2aab6099c6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\041b79a3c1c08bf01f4dc2aab6099c6c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\cjcabfebba.exe
  "C:\Users\Admin\AppData\Local\Temp\cjcabfebba.exe" 3-1-6-8-5-9-9-2-4-5-0 LE9DPDgpKjEcKlNSQUpBPzQnHitJRVFWSUpGQDs7LBsvQUhNTEQ7NDAwMTAuHyk7RDs0LhwqUE9OPk0+S1ZHQDgxMzguGCpKPFBSQFJcVExEOF9rcmw1LyxyX2pxJWtmYShhbW8nXFxrWCxlaWZsHyk7R0A6SUU/PS0vMy4sLSsyNCsxNjUvLi4qKTMzLyAsQys1KycwNC0xNDE3Gic/KTQrLRsvQTI3JSwXJkIwOC0uHyk8MDQkLxwqUE9OPk0+S1ZOTkRWPkJTNRsmR1BLP1VAU1k9UEM4OxwqUE9OPk0+S1ZMPUhFOh8pPVM8VlNORz0dLj9QQFY6S0BHSUtENxgqP0ZRUFpCT05RS0BJNDAcKlRFQEhDVEZMXVFNTDofKU5INCkeKz9TLjwaJ01MRVJFSEVcVj9EPkZEQ0VIQURET0pHNBctRU5fT1RITEREPDtwbXViHylKQEtMUEpETkReT0tASVZCPVRTOjEaJ0NAO0NUODEdLkNLWjtQTD1ISUBeP0Y+SVBOUEBEOmVbZG5cFy1ASldLS0k5P1ZATjkzMCszKyYsLSksMS8gLFNDRUA0KDIuLjUtNjMpKxcmQktSTklOOzxaS0BLQTgyLDgpKisoLCgyNTUuOS8oJUdE
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81714268976.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81714268976.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:844
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81714268976.txt bios get version
    3⤵
    PID:4184
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81714268976.txt bios get version
    3⤵
    PID:3580
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81714268976.txt bios get version
    3⤵
    PID:3264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 864
    3⤵
    - Program crash
    PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5076 -ip 5076
1⤵
PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81714268976.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81714268976.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81714268976.txt

Filesize
58B

MD5
f8e2f71e123c5a848f2a83d2a7aef11e

SHA1
5e7a9a2937fa4f06fdf3e33d7def7de431c159b4

SHA256
79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121

SHA512
8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cjcabfebba.exe

Filesize
824KB

MD5
65774a4fb3e4dd9fda6c7e5327b36204

SHA1
5df6fe5099146d361f5d43ef1da1989c9b69f53c

SHA256
2cab28727ddfedd30d2810fb361bd7fbf4e9a1316aa59de8084dbcef929fa8f6

SHA512
8453e256f628ae503f70c06e5481b5e47fcd76f301cc5a658731b52bb5846f80480255625ad33c08459b5ddee4727681c8329f48c789e672373aeece1c5a9294

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh3FE8.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh3FE8.tmp\ngz.dll

Filesize
125KB

MD5
1dca01412e8bef71651216a3231e0d5f

SHA1
94ad7b7582b7609364c6986f0b880bdd6b3cdc12

SHA256
6319d5341868ce224bbe0c370fbc40db6e94d41dac63aab35ddce06a584611e6

SHA512
17369282387096e6196ee8851f5704a213761b6ffc2a7b3dcb8a956839a75c3579cf3237619c11ca9a59b77c866095337930566703cb1b34b4842dd5200e92c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh3FE8.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit