b71698185cb526540d1b8a2992f40b0549b41de1375453adb06386b4860702f2

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe
Size 448KB
Sample240527-v1ktxsbf2s
SHA256 b71698185cb526540d1b8a2992f40b0549b41de1375453adb06386b4860702f2
MD5 79e981af90d4c2c9a4caddcc6e1a4241
SHA1 75812febe64045f49e894f1769041056670f8fb5
SHA512 4504d8b3e1826ace50116b3adff997c2eeded8a07febfc7d4425d81bd3fa452e61468c4bca1edb3f889a0886ae77fe91cf25b27d8ce139986155316d3a95bd3e
SSDEEP 12288:QPpscjcNqOQ/3AjTr7vHSujL6TcveehGfqXpd:Y/jcN0/3YrziTYJycpd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1824	TablacusInstallerStuff.exe
1064	TablacusApp.exe

Loads dropped DLL 1 IoCs

pid	Process
4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TablacusApp2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\TablacusApp\\TablacusApp.exe\""	TablacusApp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe
4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe
4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe
4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 1824	4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe	90
PID 4780 wrote to memory of 1824	4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe	90
PID 4780 wrote to memory of 1824	4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe	90
PID 4780 wrote to memory of 1064	4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe	91
PID 4780 wrote to memory of 1064	4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe	91
PID 4780 wrote to memory of 1064	4780	79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\nsq6B3.tmp\TablacusInstallerStuff.exe
  "C:\Users\Admin\AppData\Local\Temp\nsq6B3.tmp\TablacusInstallerStuff.exe" "write_patch_str_to_reg" "C:\Users\Admin\AppData\Local\Temp\79e981af90d4c2c9a4caddcc6e1a4241_JaffaCakes118.exe" "HKCU" "Software\TablacusApp" "badumt"
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Users\Admin\AppData\Roaming\TablacusApp\TablacusApp.exe
  C:\Users\Admin\AppData\Roaming\TablacusApp\TablacusApp.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3544 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TablacusInstallerStuff.exe

Path C:\Users\Admin\AppData\Local\Temp\nsq6B3.tmp\TablacusInstallerStuff.exe
Size 103KB
SHA256 fea0167b9a78895907285a19506d5dd182f0c7d2d004941d8fe4d7771e9b37aa
MD5 e60f1406e1f2e625a3f2054b4092127d
SHA1 70cc6b75301d8def17de9ff9b4ec25704d02d8c4
SHA512 926e1e2f6423404f30cecd340b6c783d6bc85ee025738364d92ed1c1c290cbfa33529d6e827a2934a39a180fb2e6f60ac82c9b30dfbd9040182dbe78b7ec6765
SSDEEP 3072:BpGQHebSZU5WsqY1xpZrmGWAg45555kE555xiEluWe:TGpbSZIB0hElr
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq6B3.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

Submit Download

TablacusApp.exe

Path C:\Users\Admin\AppData\Roaming\TablacusApp\TablacusApp.exe
Size 110KB
SHA256 753c922703981cee4b494ebddb9c01c08fc3df938fef466bebc81e1fc7b060c3
MD5 0987144fa3fa624344aff0ba49680696
SHA1 9cbb164633c6ef51d58f81fd761689e019c20aa3
SHA512 88e5e075a9ff25014674ef6a666f03af62f35946765b88e758acbb5771ab27a2a2ca6d77c16a112a11390a7f81c8e153de4b01cd966283f7acad4c7a1b4e4b98
SSDEEP 3072:Z+z/MkvBRy7fWc13i+BNmALM2VZfr1tpZB:m7Ry7LVPHFd
MD5 SHA1 SHA512 SSDEEP

Submit Download