58699ab5d4d95d6755f4582bf6f7bbd8e1ef2b91f64e9845b2646e1350649f0d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
Size 789KB
Sample240526-mpdbpsfc6z
SHA256 58699ab5d4d95d6755f4582bf6f7bbd8e1ef2b91f64e9845b2646e1350649f0d
MD5 7535365c3a3597101d7bcd9e2bacd1d7
SHA1 c4d4e596d414ab22767cd1b21fa901f735083878
SHA512 f812e0aff7bd56ba44778076390eae4c24d3cc89eb754c7160e64e8a9619541fff17d5167df3850933af8f3873512c6b15ca395fad2246b244e6c3c0a6b9ac09
SSDEEP 12288:StobbXN42nHq+EgqfRAUEcB3gOE6DZlZUXavlXluE70pFdZigcyrG4EEu44S+j:St8RHjEgYAw1hZlZTWQu7igcyKPEujz
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
696	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
912	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
824	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
696	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
696	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
696	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
696	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
696	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 696	912	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	82
PID 912 wrote to memory of 696	912	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	82
PID 912 wrote to memory of 696	912	7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	82
PID 696 wrote to memory of 1012	696	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	97
PID 696 wrote to memory of 1012	696	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	97
PID 696 wrote to memory of 1012	696	internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe	97
PID 1012 wrote to memory of 824	1012	cmd.exe	99
PID 1012 wrote to memory of 824	1012	cmd.exe	99
PID 1012 wrote to memory of 824	1012	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\nsf6C49.tmp\internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\nsf6C49.tmp\internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe /baseInstaller='C:/Users/Admin/AppData/Local/Temp/7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe' /fallbackfolder='C:/Users/Admin/AppData/Local/Temp/nsf6C49.tmp/fallbackfiles/'
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\30267.bat" "C:\Users\Admin\AppData\Local\Temp\5E6CD46B79DB4E7689F37DD939FAE141\""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 1000
      4⤵
      Runs ping.exe
      PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$IGLU2WE

Path C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\$IGLU2WE
Size 96B
SHA256 9072cbfcd756d53c5b6207bf3bc5984875cc3580ada13af73bbd2d17fc1b2b5e
MD5 3216d994f96585c20afcc28718ec7327
SHA1 3d1dafe8ab78603986bdccedeeb3ff5315569310
SHA512 c79f741967631174aec70e21d819b0a8d74c4a3155d40331dcbf413d07c7a82ee6409d5eb6d2b2d3a5632ab79f60d3cc38a32628c82ee868b475aff5929c30b4
MD5 SHA1 SHA512

Submit Download

30267.bat

Path C:\Users\Admin\AppData\Local\Temp\30267.bat
Size 212B
SHA256 cdb93994093a24991c246d8b6f7003920a510a45bfc8441521314ce22a79191d
MD5 668767f1e0c7ff2b3960447e259e9f00
SHA1 32d8abf834cce72f5e845175a0af2513b00504d8
SHA512 c07f26c8601cf91d9805004668463721ab91e14f3cc59e77e20f43d98e070ea8e742c38fe8021c4ffb1ebc02e3743ab732b66ff84bb24b59a5fdcc8634c77680
MD5 SHA1 SHA512

Submit Download

5E6CD46B79DB4E7689F37DD939FAE141_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\5E6CD46B79DB4E7689F37DD939FAE141\5E6CD46B79DB4E7689F37DD939FAE141_LogFile.txt
Size 10KB
SHA256 45e35306a036e73ad945c8e7eefe15c80781e7f83d152ef3bb810b250395b1b0
MD5 92bf32d9c172af58b1e1739b36d434fd
SHA1 caf666c98316d5a7e45feef2cd516541ccff0c2c
SHA512 3567d164ab3f2210e61175a900482a930c1a7b7fd1832a489a54922de5516b96444368920c09cfd6a811c6568ae89cd3f498520532976be6fbacd257bf9c8f34
SSDEEP 192:aGKGgGwGgGqoG5GuFGNGFGi+KGugGUGIGRGSGgG2GHj+:aGKGgGwGgGHG5GeGNGFGitGugGUGIGRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

5E6CD4~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\5E6CD46B79DB4E7689F37DD939FAE141\5E6CD4~1.TXT
Size 111KB
SHA256 cccea77540f33fdcbf0fa7b5987c31d95cd0f91ec78c11c77c03d390b145db42
MD5 a91939f0602d922a340c6144aa4fe6be
SHA1 938b70a2b15237afec8d1a58e46811d4d54dbeab
SHA512 cd9ba3b06ff23fdc5a5f477e071c6ec5464181b0c9355410df44fcb22b816a766f266e4c2300972c59f21ecc0fb2d24aba7b4f06ed1976803adc83bbeeb8d4df
SSDEEP 768:aGKGgGwGgGHG5GeGNGFGitGugGUGIGRGSGgG2GHjvGeGkGTGaoGaTGLGBGfGJGpJ:vE3L
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf6C49.tmp\StdUtils.dll
Size 14KB
SHA256 0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
MD5 21010df9bc37daffcc0b5ae190381d85
SHA1 a8ba022aafc1233894db29e40e569dfc8b280eb9
SHA512 95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
SSDEEP 192:OFb8Y8oqy2mqZc9hGBQHRx39oRxmMvURkB/Fs:qb8Y8nKqohGBKxox9vURw/a
MD5 SHA1 SHA512 SSDEEP

Submit Download

internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe

Path C:\Users\Admin\AppData\Local\Temp\nsf6C49.tmp\internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118.exe
Size 1.8MB
SHA256 f2126481c02d2a5af29e56023902a0897d05867c1caaf8079cf6e1f05dd9b209
MD5 9ab5db4bb5971035b4d287d64f9676b5
SHA1 33d17f016339572dd05c124d6243fffefd0cd039
SHA512 d36262fdd4d8bd083d8537f0698c423240c9e42b2dc0048e2470d87411f295d6e3428587b76b0486875495d502f1f31f9edf3eb6fdb914f13421b7f29fa5f066
SSDEEP 49152:G0BIrT/YNRoLlps7tZokvTopSdmX4Foni7iMmdc:GbTRps7Xj
MD5 SHA1 SHA512 SSDEEP

Submit Download

internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118_icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nsf6C49.tmp\internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118_icon.ico
Size 17KB
SHA256 78d0ed2288334f341225acee3d6200d01bb0bb80b873c448ab151d0661817bf2
MD5 055c2cb77fa2edc2802b7fd397b9c213
SHA1 e6bf5af3427539bf609cfb8904b35803a06104d3
SHA512 7dc2930b9ac4843cca0a073a9195ab0cfb684b29c13622d0f934fb4b4a45af0fbb3a033f6ba31216214a9cbc1966436c36dd065c44b014c5c2a03dfd0b005a65
SSDEEP 96:XDvM6oG5UdUcuqdXnn/mycLMLnzI5aH+es/HlayQ4c6g5FHGCpthcepdozEgzWmn:XrZ5ISe/my9I0H+eCHbQ4c6geeDozn6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118_splash.png

Path C:\Users\Admin\AppData\Local\Temp\nsf6C49.tmp\internal7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118_splash.png
Size 12KB
SHA256 1cb036da61dc7b1ad62280681c724d74cbcc313d530a799728a4d38b4e2b1983
MD5 fe272d040e82704707b19bfbf29d65ca
SHA1 460de628ea63986a7e6390a1623d8ba32dc82aee
SHA512 8a03f9f3ce7af53b2f119f9bd001ff3fd39f879de88723306e2a6c7e8cae679d2095be6d4520ea24035c86140ef01a178a0b2535674be5c39b8b2dde4d082b1b
SSDEEP 384:uLGOts/16mbzoclsCGmutWLP5baar1nflf:uLjLQzochu8RbPrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/696-80-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

Download

memory/696-214-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

Download

memory/912-295-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/912-123-0x0000000000400000-0x000000000043B000-memory.dmp

Download