889827ac4a69e58ce103446535ebef876b1bd30572ec5eba0ce1892891958c2b

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b20932687a79b2cfb2d3289e7618442_JaffaCakes118.exe
Size

270KB
MD5

0b20932687a79b2cfb2d3289e7618442
SHA1

b23574ebb64bbd595a232b13dd0bdd3d9044d538
SHA256

889827ac4a69e58ce103446535ebef876b1bd30572ec5eba0ce1892891958c2b
SHA512

ebf85c4731e6f0ffceb5ccf52b45697a4adc2654f8243b95dbffa3c3342d880c11325366ba447eb453721fb1117732d77a1f886aa01cbaea45cefd6c2348e63d
SSDEEP

6144:AzSHm8gnhTB0FbhbYU8p3ja19eVEecqBPY:AOG8ghTaFbNYU43ja0c8g

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	0b20932687a79b2cfb2d3289e7618442_JaffaCakes118.exe
Token: SeRestorePrivilege	4700	dw20.exe
Token: SeBackupPrivilege	4700	dw20.exe
Token: SeBackupPrivilege	4700	dw20.exe
Token: SeBackupPrivilege	4700	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 4700	2352	0b20932687a79b2cfb2d3289e7618442_JaffaCakes118.exe	80
PID 2352 wrote to memory of 4700	2352	0b20932687a79b2cfb2d3289e7618442_JaffaCakes118.exe	80
PID 2352 wrote to memory of 4700	2352	0b20932687a79b2cfb2d3289e7618442_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\0b20932687a79b2cfb2d3289e7618442_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b20932687a79b2cfb2d3289e7618442_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 940
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-6-0x0000000077150000-0x0000000077151000-memory.dmp

Filesize
4KB

Download
memory/2352-7-0x0000000077130000-0x0000000077220000-memory.dmp

Filesize
960KB

Download
memory/2352-8-0x0000000077130000-0x0000000077220000-memory.dmp

Filesize
960KB

Download
memory/2352-11-0x0000000077130000-0x0000000077220000-memory.dmp

Filesize
960KB

Download
memory/2352-10-0x0000000077130000-0x0000000077220000-memory.dmp

Filesize
960KB

Download
memory/2352-9-0x0000000077130000-0x0000000077220000-memory.dmp

Filesize
960KB

Download
memory/2352-31-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-52-0x0000000077130000-0x0000000077220000-memory.dmp

Filesize
960KB

Download
memory/2352-70-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-78-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-76-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-74-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-68-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-66-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-64-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-62-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-60-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-58-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-56-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-54-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-49-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-51-0x0000000077130000-0x0000000077220000-memory.dmp

Filesize
960KB

Download
memory/2352-50-0x0000000077130000-0x0000000077220000-memory.dmp

Filesize
960KB

Download
memory/2352-72-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-48-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-43-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-41-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-39-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-37-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-35-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-33-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-29-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-28-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-25-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-23-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-21-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-19-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-17-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-15-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-13-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-12-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-46-0x0000000000450000-0x0000000000488000-memory.dmp

Filesize
224KB

Download
memory/2352-537-0x0000000077130000-0x0000000077220000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads