bec1c2929d1574ee98827406a343e7565f8513f15a0b10c44b0853210be66066

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe
Size

108KB
MD5

07faab712ed3c1abc45c4ced60e2c344
SHA1

ab74bfba8845b64139a5763548b6168459637d5b
SHA256

bec1c2929d1574ee98827406a343e7565f8513f15a0b10c44b0853210be66066
SHA512

6e6e6876279633f78957151ca9b14ce06d6b652f675b1cc396935159871079efdda1aac8becc8efbb3f9cdba916aae9c442495399cad8cf66c99e9d5e48c0071
SSDEEP

1536:4KzoDZsYu+iU5WvZp0T2g/HG+5cuuGFVkRYlDE5xJK:4woaY7qZp0T2CHpquuC98

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/656-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/656-2-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/656-3-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/656-4-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 656	3000	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	656	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 656	3000	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	83
PID 3000 wrote to memory of 656	3000	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	83
PID 3000 wrote to memory of 656	3000	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	83
PID 3000 wrote to memory of 656	3000	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	83
PID 3000 wrote to memory of 656	3000	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	83
PID 3000 wrote to memory of 656	3000	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	83
PID 3000 wrote to memory of 656	3000	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	83
PID 3000 wrote to memory of 656	3000	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	83
PID 656 wrote to memory of 4132	656	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	89
PID 656 wrote to memory of 4132	656	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	89
PID 656 wrote to memory of 4132	656	07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\07faab712ed3c1abc45c4ced60e2c344_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\07FAAB~1.EXE > nul
    3⤵
    PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\211347183

Filesize
111B

MD5
e7a9350210b4dba641f6020447c96045

SHA1
581accef4a8b7fbed97291fe7dd4e113f794ec80

SHA256
08142330655deb1526dcc56795c92eb5c13012f75b599d5ac68db4027953ed80

SHA512
2dcb8ad4eac1b103da4f806a49d7a0efcc64d362865a18efb257b45059bc1453d053136073009929415200f48f47b03f8e19e52a8af7cb846ad081e0318586a2

Download Submit
memory/656-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/656-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/656-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/656-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download