0e55d72fb5166be5c836c7d4cb407d229eeb9234ee9fd92b3a490ad8d77e3c83

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8af6689c4286fa9139d2367f449c10c9_JaffaCakes118.exe
Size 3.3MB
Sample240601-tbfy1agf76
SHA256 0e55d72fb5166be5c836c7d4cb407d229eeb9234ee9fd92b3a490ad8d77e3c83
MD5 8af6689c4286fa9139d2367f449c10c9
SHA1 93cc29907dd79e63d94ec4fe18ef4d77c1ed79e9
SHA512 2200ac384db1cd87f03d57a69d0f089bb4d86f93bb19ff39e172dc25f175a81fb4c440987775714b1d52a0a291070f935c7171f80d9cd4d271a7d34500bd8360
SSDEEP 98304:m+puhG3GyTGSyO/oRWMvgAmHlqY50DwzkE4qxO0JKjWznzl4:EhG3pTGkwRWIgFAXwd4qcKKjWTC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

miner persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	hid.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	windll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	8af6689c4286fa9139d2367f449c10c9_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	Explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	dwn.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 6 IoCs

pid	Process
3192	Explorer.exe
456	svchost.exe
1212	dwn.exe
2496	hid.exe
4460	windll.exe
2272	system.exe

Loads dropped DLL 1 IoCs

pid	Process
2272	system.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BBFOHMJJNCAKLAC = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Explorer.exe"	8af6689c4286fa9139d2367f449c10c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MAKER = "C:\\Intel\\Logs\\update.exe /autorun"	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8af6689c4286fa9139d2367f449c10c9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3192	2660	8af6689c4286fa9139d2367f449c10c9_JaffaCakes118.exe	83
PID 2660 wrote to memory of 3192	2660	8af6689c4286fa9139d2367f449c10c9_JaffaCakes118.exe	83
PID 2660 wrote to memory of 3192	2660	8af6689c4286fa9139d2367f449c10c9_JaffaCakes118.exe	83
PID 3192 wrote to memory of 456	3192	Explorer.exe	86
PID 3192 wrote to memory of 456	3192	Explorer.exe	86
PID 3192 wrote to memory of 1212	3192	Explorer.exe	88
PID 3192 wrote to memory of 1212	3192	Explorer.exe	88
PID 3192 wrote to memory of 2496	3192	Explorer.exe	89
PID 3192 wrote to memory of 2496	3192	Explorer.exe	89
PID 456 wrote to memory of 3768	456	svchost.exe	90
PID 456 wrote to memory of 3768	456	svchost.exe	90
PID 1212 wrote to memory of 1656	1212	dwn.exe	91
PID 1212 wrote to memory of 1656	1212	dwn.exe	91
PID 2496 wrote to memory of 4648	2496	hid.exe	92
PID 2496 wrote to memory of 4648	2496	hid.exe	92
PID 4648 wrote to memory of 1700	4648	cmd.exe	94
PID 4648 wrote to memory of 1700	4648	cmd.exe	94
PID 1656 wrote to memory of 4460	1656	wscript.exe	95
PID 1656 wrote to memory of 4460	1656	wscript.exe	95
PID 4460 wrote to memory of 4064	4460	windll.exe	97
PID 4460 wrote to memory of 4064	4460	windll.exe	97
PID 4064 wrote to memory of 2272	4064	cmd.exe	99
PID 4064 wrote to memory of 2272	4064	cmd.exe	99

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1700	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8af6689c4286fa9139d2367f449c10c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8af6689c4286fa9139d2367f449c10c9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\Explorer.exe
  "C:\Users\Admin\AppData\Local\Temp\Explorer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Intel\Logs\svchost.exe
    "C:\Intel\Logs\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\3D18.tmp\3D19.vbs
      4⤵
      Adds Run key to start application
      PID:3768
- - C:\Intel\Logs\dwn.exe
    "C:\Intel\Logs\dwn.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\3D57.tmp\3D58.vbs
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:1656
    - - C:\Intel\Logs\windll.exe
        
        "C:\Intel\Logs\windll.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4460
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3EBE.tmp\3EBF.bat C:\Intel\Logs\windll.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Intel\Logs\system.exe
        
        system.exe -a cryptonight -o stratum+tcp://xmr.pool.minergate.com:45560 -u [email protected] -t 1
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2272
- - C:\Intel\Logs\hid.exe
    "C:\Intel\Logs\hid.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3D58.tmp\3D68.bat C:\Intel\Logs\hid.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +r C:\Intel\Logs\*.*
        5⤵
        Views/modifies file attributes
        
        PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwn.exe

Path C:\Intel\Logs\dwn.exe
Size 98KB
SHA256 856b559ad44ef967f59976f1f3323587ca9440eb2fd680cfd3046d9231bd2a46
MD5 7900311d7cb34853a4f8c23dd900e828
SHA1 2ab9c0c258d683110302c3d678ee8138c6f70512
SHA512 283606546d32dd36b80425970239e78f0cb3641b8addaf0ab54796d8fd33b502163a06f27a51978b108b791d59790f9af789da435f2455b123111eb702408e9d
SSDEEP 1536:bRftiQqloECiLhewp3fcluwnzWdT4z4FBeMh3JWck:ZtDHwpPclvnzM8MTeMPQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hid.exe

Path C:\Intel\Logs\hid.exe
Size 102KB
SHA256 2e015189ce3535fec8b97a9b5185c58f50c653bb2a23b1aeb51d61b92389f3f2
MD5 f88ccb97a8652c01ce4f7318261c3c1f
SHA1 6260afa20ee270a01f77a0be7e71e553df74f074
SHA512 63f27a4d2dcb5913f18af3fb4d280b05e340d373594e70fad232f0d136d53384b11a26b423fd0895deed5ee28b6cb1386e7ca8b37e6c8c7d352b2584dcfba651
SSDEEP 1536:wPq05otV8SIoWZZnUwAUsPvds4hvHvVIeI0j0ph7iLTuUTJDJr13cu:8q05eW51sPFs4hvHvVING0GLTuUn1/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr120.dll

Path C:\Intel\Logs\msvcr120.dll
Size 940KB
SHA256 ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c
MD5 9c861c079dd81762b6c54e37597b7712
SHA1 62cb65a1d79e2c5ada0c7bfc04c18693567c90d0
SHA512 3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7
SSDEEP 24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Intel\Logs\svchost.exe
Size 98KB
SHA256 a6b30f0f1c4617a8f98bebb2185e99ddadbf9df03c84c5bf95255b52e35245bb
MD5 0ca01363801dc56efbc9dca20a41e216
SHA1 ecff7c5fa1df1b89d60f6e6a93195a3b6f32df54
SHA512 b7244f28f3efd85d03eceaf37eccb2f9ce6495ce7d9e9b6e79425190442529164f7293821de8c6115111c1f6f2a45fd8e797955df9b23b7a6f33f4680c2227b8
SSDEEP 1536:jRftiQqloECiLhewp3fcluwnzWdT4z4FBeMc3JBcc:htDHwpPclvnzM8MTeMwD
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Intel\Logs\system.exe
Size 4.5MB
SHA256 3e08ba9c617049460441288c0d43e92065e9d8783ad7c47e63e7389061d0d50d
MD5 485d21053bcf2fdd7dfdf609121c046d
SHA1 524936ad9a71cd2b13919c63eeb289ada4a58350
SHA512 5b03bfc631b2b70db69b9d718996cec25c3f01cee80791baa859baf4e7bf895d7c72ca52b334d2419736036b08d911ea36cf601109353b81e492756d013e7bd4
SSDEEP 49152:1cwDRVi/xk9HteAJdztHTn+enTErGBBVTt8DSe:1Lqa946w
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Intel\Logs\update.exe
Size 1.7MB
SHA256 7f5bd3c36b760ff8b92e12a94c1c6e1798958c100245e8d8438709bb88b7cc42
MD5 9d8c89633174dc2b8bc1839a4563079a
SHA1 63ae611ab78f7ba059721f9c2bfb7608b90205c1
SHA512 53a5024b7976c8e52a4428592e0bc44f8beaed48f03fbc06801dceb2a25f94efc0661b44774b66f4e3b40eda060c6b3b6d93f1796747b777ec8f219096fa790c
SSDEEP 49152:rZWFgG0Tei/W9PMg9CL8va8XDXN3Rn+BMJl4zWHn1n:rPG0Y9JM6x3U44zanh
MD5 SHA1 SHA512 SSDEEP

Submit Download

windll.exe

Path C:\Intel\Logs\windll.exe
Size 102KB
SHA256 cff892897705fcba554afc33d555a79f16891a8455641e4c82490d838cd92081
MD5 801d7a52ad7d8af47acc42e445bb55a1
SHA1 f947b11cfacb63d6dbae1bb92a1c9dc0853493a8
SHA512 7ce0a4b30e9e5ef6e38e5a2e3f05637854dfa67d500fe0c4decebb89549d071a7649baecaca91d3abbf53006d6df652600b2665d7822cf8105d01ecac8dcbf0b
SSDEEP 1536:0rq05otV8SIoWZZnUwAUsPvds4hvHvVIeI0j0ph7iLTuUQJDJr/9vcM:0q05eW51sPFs4hvHvVING0GLTuU2/91
MD5 SHA1 SHA512 SSDEEP

Submit Download

3D19.vbs

Path C:\Users\Admin\AppData\Local\Temp\3D18.tmp\3D19.vbs
Size 308B
SHA256 c2a166f29323d378d010ef05bcac328854f0e393b35b8089b50cfe8449b6ea71
MD5 9c29bead93ce7593769ca751a9e0893f
SHA1 92fb5d17c72026809e15a2bfddb89e7287bbceff
SHA512 c909fd4200a756abe2682293792e619a30cc276f61df747f807cdcddb95430f9f5f9a3ac8999636266839a13bf7a20a8a0319ca1b385fa5639e0a173561c6142
MD5 SHA1 SHA512

Submit Download

3D58.vbs

Path C:\Users\Admin\AppData\Local\Temp\3D57.tmp\3D58.vbs
Size 635B
SHA256 2a2f659331a3e8a746d40bba8fee98a8664198a1186a73b8a754f1c95b380395
MD5 a594a27e0750f346ece397afd3fb2892
SHA1 5841f83c5db6032876a356925256ddbbca452ab7
SHA512 54d0dde2aeb13e1f00d105b7d29c77c1c03faba4ee7e9f83d434794c015ce2051907836545cfc1c37aedfcfaa1007dd6438a38dcee9e631b162a72e3736e04cc
MD5 SHA1 SHA512

Submit Download

3D68.bat

Path C:\Users\Admin\AppData\Local\Temp\3D58.tmp\3D68.bat
Size 56B
SHA256 79e539e35e3865aac7684edd59175049c96197ef05af423ac35d1cc5311f3b42
MD5 c748f93d15c1a735b810caad1bd93537
SHA1 9e5f99866cd18270d7346c57657d3091ea76404a
SHA512 fcf4b8d7d7e432df4ce8b583c6909d7b1134ae622b749cd3591da84d8a5e56b0f02b1b33219d39f65c41fae8a623b128cfb0376ef770ff8edec9dd970fd1902d
MD5 SHA1 SHA512

Submit Download

3EBF.bat

Path C:\Users\Admin\AppData\Local\Temp\3EBE.tmp\3EBF.bat
Size 166B
SHA256 8f2d34a7dda3a261ae73a83d39e2eb75f8cad0a2f295a523a8798cc579665c06
MD5 a9d2b6f87c23d6520766a6d8c26a4798
SHA1 b50fa1de0b6654630f42b2f7eba7934db4ce00a1
SHA512 7daa74e4ae4977373f5ba4d92c6430d5442d5770f409b5e4fc55534f20c695bd3e49d6f19bb01e6266d2325ce80e39a16d5890879a61c32805c73468e0499a70
MD5 SHA1 SHA512

Submit Download

Explorer.exe

Path C:\Users\Admin\AppData\Local\Temp\Explorer.exe
Size 3.3MB
SHA256 4895d6bf555824843d0a294df354e3700212e353a19983df04e11ed949d46649
MD5 11b55669f27df84f93e8b32eab7af16d
SHA1 44b22d4fbc14f6d0d3e5292895cbac94a0153ef7
SHA512 6a1984c5e4c8622b1075f849dcdc38150daf6746dd96150f37ed1b935047e526de5ac11a5e60f804fb8b22db78d00bbe1d147746b264c5661e0e3bc434b2aca4
SSDEEP 98304:rtG0Y9JM6x3U44zanssGNMhKsuIvXttoxb:5GprM6xkgyMUIdCb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads