c0287fa0d5cec11a966f1d14c99d186293652e1de90b0400bf8dfaab1a33de9a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9151203eecfe10ffdc6956f0c600de3c_JaffaCakes118.exe
Size 101KB
Sample240603-lp2tmabf78
SHA256 c0287fa0d5cec11a966f1d14c99d186293652e1de90b0400bf8dfaab1a33de9a
MD5 9151203eecfe10ffdc6956f0c600de3c
SHA1 6eeaf374712a20702a45c56090c9f2d537b7da29
SHA512 2a23fa302dbf608c3721f455c6010dc96f85ef7a98152979241ada416385ee9b7c6ac33c600f18f2b3db852f342523e9df5a3057884771c5e3555a0452a30ebb
SSDEEP 1536:D/7ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIftwIsjpUpsmb:DzFfHgTWmCRkGbKGLeNTBftjsjpCjb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	reg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4152	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3996	2664	9151203eecfe10ffdc6956f0c600de3c_JaffaCakes118.exe	85
PID 2664 wrote to memory of 3996	2664	9151203eecfe10ffdc6956f0c600de3c_JaffaCakes118.exe	85
PID 3996 wrote to memory of 3256	3996	cmd.exe	86
PID 3996 wrote to memory of 3256	3996	cmd.exe	86
PID 3256 wrote to memory of 3348	3256	cmd.exe	87
PID 3256 wrote to memory of 3348	3256	cmd.exe	87
PID 3996 wrote to memory of 3264	3996	cmd.exe	88
PID 3996 wrote to memory of 3264	3996	cmd.exe	88
PID 3996 wrote to memory of 4216	3996	cmd.exe	89
PID 3996 wrote to memory of 4216	3996	cmd.exe	89
PID 3996 wrote to memory of 2256	3996	cmd.exe	90
PID 3996 wrote to memory of 2256	3996	cmd.exe	90
PID 3996 wrote to memory of 3116	3996	cmd.exe	91
PID 3996 wrote to memory of 3116	3996	cmd.exe	91
PID 3996 wrote to memory of 1588	3996	cmd.exe	92
PID 3996 wrote to memory of 1588	3996	cmd.exe	92
PID 3996 wrote to memory of 4488	3996	cmd.exe	93
PID 3996 wrote to memory of 4488	3996	cmd.exe	93
PID 3996 wrote to memory of 3692	3996	cmd.exe	94
PID 3996 wrote to memory of 3692	3996	cmd.exe	94
PID 3996 wrote to memory of 2560	3996	cmd.exe	95
PID 3996 wrote to memory of 2560	3996	cmd.exe	95
PID 3996 wrote to memory of 2004	3996	cmd.exe	97
PID 3996 wrote to memory of 2004	3996	cmd.exe	97
PID 3996 wrote to memory of 1676	3996	cmd.exe	98
PID 3996 wrote to memory of 1676	3996	cmd.exe	98
PID 3996 wrote to memory of 5104	3996	cmd.exe	99
PID 3996 wrote to memory of 5104	3996	cmd.exe	99
PID 3996 wrote to memory of 2120	3996	cmd.exe	100
PID 3996 wrote to memory of 2120	3996	cmd.exe	100
PID 3996 wrote to memory of 4764	3996	cmd.exe	101
PID 3996 wrote to memory of 4764	3996	cmd.exe	101
PID 3996 wrote to memory of 2912	3996	cmd.exe	102
PID 3996 wrote to memory of 2912	3996	cmd.exe	102
PID 3996 wrote to memory of 3648	3996	cmd.exe	103
PID 3996 wrote to memory of 3648	3996	cmd.exe	103
PID 3996 wrote to memory of 4496	3996	cmd.exe	104
PID 3996 wrote to memory of 4496	3996	cmd.exe	104
PID 3996 wrote to memory of 2056	3996	cmd.exe	105
PID 3996 wrote to memory of 2056	3996	cmd.exe	105
PID 3996 wrote to memory of 3092	3996	cmd.exe	106
PID 3996 wrote to memory of 3092	3996	cmd.exe	106
PID 3996 wrote to memory of 1476	3996	cmd.exe	107
PID 3996 wrote to memory of 1476	3996	cmd.exe	107
PID 3996 wrote to memory of 1532	3996	cmd.exe	108
PID 3996 wrote to memory of 1532	3996	cmd.exe	108
PID 3996 wrote to memory of 3096	3996	cmd.exe	109
PID 3996 wrote to memory of 3096	3996	cmd.exe	109
PID 3996 wrote to memory of 4492	3996	cmd.exe	110
PID 3996 wrote to memory of 4492	3996	cmd.exe	110
PID 3996 wrote to memory of 1684	3996	cmd.exe	111
PID 3996 wrote to memory of 1684	3996	cmd.exe	111
PID 3996 wrote to memory of 3292	3996	cmd.exe	112
PID 3996 wrote to memory of 3292	3996	cmd.exe	112
PID 3996 wrote to memory of 4248	3996	cmd.exe	113
PID 3996 wrote to memory of 4248	3996	cmd.exe	113
PID 3996 wrote to memory of 4436	3996	cmd.exe	114
PID 3996 wrote to memory of 4436	3996	cmd.exe	114
PID 3996 wrote to memory of 1900	3996	cmd.exe	115
PID 3996 wrote to memory of 1900	3996	cmd.exe	115
PID 3996 wrote to memory of 2652	3996	cmd.exe	116
PID 3996 wrote to memory of 2652	3996	cmd.exe	116
PID 3996 wrote to memory of 4152	3996	cmd.exe	117
PID 3996 wrote to memory of 4152	3996	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\9151203eecfe10ffdc6956f0c600de3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9151203eecfe10ffdc6956f0c600de3c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\418D.tmp\418E.tmp\418F.bat C:\Users\Admin\AppData\Local\Temp\9151203eecfe10ffdc6956f0c600de3c_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\Software\Microsoft\Internet Explorer" /v svcVersion
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\Software\Microsoft\Internet Explorer" /v svcVersion
      4⤵
      PID:3348
- - C:\Windows\system32\chcp.com
    chcp 1252
    3⤵
    PID:3264
- - C:\Windows\system32\chcp.com
    chcp 850
    3⤵
    PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2256
- - C:\Windows\system32\find.exe
    find /i "Windows 95"
    3⤵
    PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:1588
- - C:\Windows\system32\find.exe
    find /i "Windows 98"
    3⤵
    PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:3692
- - C:\Windows\system32\find.exe
    find /i "Windows Millennium"
    3⤵
    PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2004
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 5"
    3⤵
    PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:5104
- - C:\Windows\system32\find.exe
    find "XP"
    3⤵
    PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:4764
- - C:\Windows\system32\find.exe
    find "2000"
    3⤵
    PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:3648
- - C:\Windows\system32\find.exe
    find "NT"
    3⤵
    PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2056
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 6.0"
    3⤵
    PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:1476
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 6.1"
    3⤵
    PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:3096
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 6.2"
    3⤵
    PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:1684
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 6.3"
    3⤵
    PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:4248
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 10.0"
    3⤵
    PID:4436
- - C:\Windows\system32\reg.exe
    reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    3⤵
    - Checks processor information in registry
    PID:1900
- - C:\Windows\system32\find.exe
    find /i "x86"
    3⤵
    PID:2652
- - C:\Windows\system32\PING.EXE
    ping -n 15 localhost
    3⤵
    - Runs ping.exe
    PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

418F.bat

Path C:\Users\Admin\AppData\Local\Temp\418D.tmp\418E.tmp\418F.bat
Size 8KB
SHA256 f1bf4b8c5971b82256f160dab60cdc3008a79cb1c957011b8bb0a79e6466e9b9
MD5 cc4522663e0c3caa20cdddfa00eb0996
SHA1 0ed22a0964cd5bcfb35864fc6ceee44c869a7bbb
SHA512 ba6297471ab4e5135d96958ccc0ce9ec3f4266910af7214c39c9270a8702f465c55210af45de671bf73a625e066214566704157f240691ce4fdec1f9d5829923
SSDEEP 192:WKEf8uTWbQlacSZjfKwgWzhjlP4xjRSfVem0D3IpDoSbT08tW8KNSi+wRww:kWbQlaFRlpDxbTriZ
MD5 SHA1 SHA512 SSDEEP

Submit Download