bff7a0902012ad8f3d620b871c429f3fde3a0d709b72c844233cca8c542238c3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
Size

127KB
MD5

088b6acc433f753a51fa7c919ea7e289
SHA1

db49d1f3b70325274800af0fe9f67eaf354ae9a5
SHA256

bff7a0902012ad8f3d620b871c429f3fde3a0d709b72c844233cca8c542238c3
SHA512

232dcf694a8d2ab304ea74c98369f2c993f402de15137a7990651fbcd9db032904b81235ba245dd893c4904aac8622e6cbe5d913b85b12c8164f1e1a2b8ee171
SSDEEP

1536:MHxrKCY4pNdpyHGhacVUA7vQ5P+oOocTG7BJytP591U3zBrJz5Udrc7YZ8jj4nsV:sxWCdNPxhat5B8CkP538zhJSGZj52S

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oobe\info\BENQLOGO.GIF	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\info\BenQ_BADGE.BMP	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\info\BENQ_LOGO.PNG	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\info\OOBE.XML	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\info\USER_TILE.BMP	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\info\BENQ_LOGO.PNG	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\info\OOBE.XML	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\info\BenQ_MCE_LOGO.PNG	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\info\BenQ_MCE_LOGO.PNG	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\info	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\info\BENQ_BADGE.PNG	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\info\BENQ_BADGE.PNG	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\info\BenQ_BAR.PNG	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\info\BenQ_BAR.PNG	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\info\BENQLOGO.GIF	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\info\BenQ_BADGE.BMP	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\info\reg.reg	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\info\reg.reg	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\info\USER_TILE.BMP	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_240596000	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
3448	regedit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 3448	1496	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe	82
PID 1496 wrote to memory of 3448	1496	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe	82
PID 1496 wrote to memory of 3448	1496	088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\088b6acc433f753a51fa7c919ea7e289_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\regedit.exe" /s C:\Windows\SYSTEM32\oobe\info\reg.REG
  2⤵
  - Runs .reg file with regedit
  PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\oobe\info\reg.reg

Filesize
633B

MD5
8ff36919a089be01517778bed2949484

SHA1
17715f2a6ffe4b39ee86db7babfbed6adfce116b

SHA256
7ea8742f3077f93053970de7d89503a8e5d769c38a99ceaf3e75e43261a1b2ce

SHA512
17819507ee493c6d3e458bd9b14dd71e470e47429f5ac7b6a2d4b754fd01c0e547146d77221f6ab0c1365843e4743875109bb659f60371a7eab4286651b0d2ba

Download Submit
memory/1496-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1496-20-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download