1be816ebbd29f23db510c2499edbc53cae0b435395b3dde6b6eae1e743e08e99

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe
Size

45KB
MD5

001bcf63aed8ec450d3b1ea31a528c89
SHA1

c016ae49ddd3872812a222f24a8c50880b10198c
SHA256

1be816ebbd29f23db510c2499edbc53cae0b435395b3dde6b6eae1e743e08e99
SHA512

6c12244aca0e2dcc8374bf2e0dc5f1fe206587260ae530813052bd9135ccdd54dd1c1654b0efe53c2d468c9c2df1e09441dca315dca9792b0fac53053aed30c7
SSDEEP

768:isHyUhAQuyD1OS3s0wz8F689JRkeb0dQKsJSPuf+6h6eyZ73xPDfM:iehAQuys4s5z8RCakmG6h6eyZ73xPDf

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2004	sysmgr.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	sysmgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft(R) System Manager = "C:\\Windows\\system32\\sysmgr.exe"	001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvcrt2.dll	001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sysmgr.exe	001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 2004	3240	001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe	82
PID 3240 wrote to memory of 2004	3240	001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe	82
PID 3240 wrote to memory of 2004	3240	001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\sysmgr.exe
  "C:\Windows\system32\sysmgr.exe" del "C:\Users\Admin\AppData\Local\Temp\001bcf63aed8ec450d3b1ea31a528c89_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msvcrt2.dll

Filesize
100KB

MD5
0930381996800d58bd834f5127219170

SHA1
3323f53f5384a4eaa75c2762bf0e9d58c41d07a1

SHA256
91d1c145d8448f77a42aff1e7b08105d78a88b1bd34d9215384d8277b22732ab

SHA512
bf64e67f328ba4b66d99cb0a66859545aa6389917225929b64ddceaa0dde762236ab6a9aae0bee78bb14bd2a68995c3ccd9966d721ec84f98f07a8c5079eef81

Download Submit
C:\Windows\SysWOW64\sysmgr.exe

Filesize
45KB

MD5
001bcf63aed8ec450d3b1ea31a528c89

SHA1
c016ae49ddd3872812a222f24a8c50880b10198c

SHA256
1be816ebbd29f23db510c2499edbc53cae0b435395b3dde6b6eae1e743e08e99

SHA512
6c12244aca0e2dcc8374bf2e0dc5f1fe206587260ae530813052bd9135ccdd54dd1c1654b0efe53c2d468c9c2df1e09441dca315dca9792b0fac53053aed30c7

Download Submit
memory/2004-11-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3240-9-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads