ee59e629a89a818dc0c0d9e4ecf4ce0e54db4f300e9b61853d16a01ffd3dafd4

Analysis

max time kernel
143s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe
Size

78KB
MD5

94b432388eb811c034b91b0a0f699377
SHA1

b0e7abe89e2d44d83332e57cd41c413c426f9199
SHA256

ee59e629a89a818dc0c0d9e4ecf4ce0e54db4f300e9b61853d16a01ffd3dafd4
SHA512

f1bb96ce016abdc7c6b6ab2be06bcd3fed193ca5cf150ba5af2099f1e339aca73295503030f55341ffc248f41dc50b66a7b599a94dabf692ab1b49a342198702
SSDEEP

1536:lfsV14ogH9rbK1DowtXN5U3FjAXScUC30SWEk4JgTqkKk6YqwFYtitK2TZ:lkIbdK1DokN5U3FjtQ0SWyJgT5D6wK2

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winamp.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\system32\winamp.exe = "C:\\Windows\\system32\\winamp.exe:*:Enabled:Windows DLL Loader"	winamp.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winamp.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	spooIsv.exe

Executes dropped EXE 4 IoCs

pid	Process
2396	spooIsv.exe
4480	spooIsv.exe
4432	winamp.exe
4392	winamp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows DLL Loader = "C:\\Windows\\system32\\winamp.exe"	winamp.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winamp.exe	spooIsv.exe
File created	C:\Windows\SysWOW64\qoyc.bat	spooIsv.exe
File created	C:\Windows\SysWOW64\explorer.exe	winamp.exe
File created	C:\Windows\SysWOW64\spooIsv.exe	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\spooIsv.exe	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winamp.exe	spooIsv.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 708	1868	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	81
PID 2396 set thread context of 4480	2396	spooIsv.exe	85
PID 4432 set thread context of 4392	4432	winamp.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 708	1868	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	81
PID 1868 wrote to memory of 708	1868	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	81
PID 1868 wrote to memory of 708	1868	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	81
PID 1868 wrote to memory of 708	1868	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	81
PID 1868 wrote to memory of 708	1868	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	81
PID 1868 wrote to memory of 708	1868	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	81
PID 1868 wrote to memory of 708	1868	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	81
PID 708 wrote to memory of 392	708	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	82
PID 708 wrote to memory of 392	708	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	82
PID 708 wrote to memory of 392	708	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	82
PID 708 wrote to memory of 2396	708	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	84
PID 708 wrote to memory of 2396	708	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	84
PID 708 wrote to memory of 2396	708	94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe	84
PID 2396 wrote to memory of 4480	2396	spooIsv.exe	85
PID 2396 wrote to memory of 4480	2396	spooIsv.exe	85
PID 2396 wrote to memory of 4480	2396	spooIsv.exe	85
PID 2396 wrote to memory of 4480	2396	spooIsv.exe	85
PID 2396 wrote to memory of 4480	2396	spooIsv.exe	85
PID 2396 wrote to memory of 4480	2396	spooIsv.exe	85
PID 2396 wrote to memory of 4480	2396	spooIsv.exe	85
PID 4480 wrote to memory of 1748	4480	spooIsv.exe	86
PID 4480 wrote to memory of 1748	4480	spooIsv.exe	86
PID 4480 wrote to memory of 1748	4480	spooIsv.exe	86
PID 4480 wrote to memory of 4432	4480	spooIsv.exe	88
PID 4480 wrote to memory of 4432	4480	spooIsv.exe	88
PID 4480 wrote to memory of 4432	4480	spooIsv.exe	88
PID 4432 wrote to memory of 4392	4432	winamp.exe	89
PID 4432 wrote to memory of 4392	4432	winamp.exe	89
PID 4432 wrote to memory of 4392	4432	winamp.exe	89
PID 4432 wrote to memory of 4392	4432	winamp.exe	89
PID 4432 wrote to memory of 4392	4432	winamp.exe	89
PID 4432 wrote to memory of 4392	4432	winamp.exe	89
PID 4432 wrote to memory of 4392	4432	winamp.exe	89

C:\Users\Admin\AppData\Local\Temp\94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\Temp\94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\94b432388eb811c034b91b0a0f699377_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iqoe.bat" "
    3⤵
    PID:392
- - C:\Windows\SysWOW64\spooIsv.exe
    C:\Windows\system32\spooIsv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\SysWOW64\spooIsv.exe
      "C:\Windows\SysWOW64\spooIsv.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\SysWOW64\qoyc.bat" "
        5⤵
        
        PID:1748
    - - C:\Windows\SysWOW64\winamp.exe
        
        C:\Windows\system32\winamp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4432
      - C:\Windows\SysWOW64\winamp.exe
        
        "C:\Windows\SysWOW64\winamp.exe"
        6⤵
        Modifies firewall policy service
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\iqoe.bat

Filesize
240B

MD5
f9c44a217405526802c2548dee1f551a

SHA1
59b56296e0638244e328a668f671676a6ac85e57

SHA256
e599b3ba46a833a53ae57c08e86219da1c21f8558801469566ba0d0a7986cf57

SHA512
7b406a0789f051bafcacf0e313deb4a4580e477bdf601cc7f292fd378363cc6d3d3eff7a72b233e67fde79667bca2047271538ae4160108e0968e3680beb0a03

Download Submit
C:\Windows\SysWOW64\qoyc.bat

Filesize
123B

MD5
888b51313ad98fa5f04bcec3f183aa34

SHA1
1ec0bdfd129adb73b4176c11efebc376d11bc63f

SHA256
6a05dc3820f61f0a09a9b51d7d2c5ac836a1f399d7498d73e30845aeadec6b3a

SHA512
426e062ab3dc96a9621d5b89476c343deb0e7dad0655905b79253b5a277e9d5f4132cf65d77759e12e3db7d03ec9ef27d193bff29f5d549deefee88bc07ee70d

Download Submit
C:\Windows\SysWOW64\spooIsv.exe

Filesize
78KB

MD5
94b432388eb811c034b91b0a0f699377

SHA1
b0e7abe89e2d44d83332e57cd41c413c426f9199

SHA256
ee59e629a89a818dc0c0d9e4ecf4ce0e54db4f300e9b61853d16a01ffd3dafd4

SHA512
f1bb96ce016abdc7c6b6ab2be06bcd3fed193ca5cf150ba5af2099f1e339aca73295503030f55341ffc248f41dc50b66a7b599a94dabf692ab1b49a342198702

Download Submit
memory/708-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/708-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/708-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4392-37-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4392-43-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4480-29-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads