5411f34d1c462d4045213191f5b346e00c67c36b9494f37337ac2ee929f7c8d3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe
Size

352KB
MD5

08ae32a82a03c7905b901e1669cd59c4
SHA1

87f1684c0059d7400a2641c9dabb392f054fa5fe
SHA256

5411f34d1c462d4045213191f5b346e00c67c36b9494f37337ac2ee929f7c8d3
SHA512

d79b35efb6f6e013bad029725d31ce7b7767b1b0fa488e65d4bcdd3e9564c4738d31157794cff64984f1bf4cc544da4ff3a4a0194b4c9f57fb6827759ade3335
SSDEEP

3072:NccANHSKIGzcQa3/t5G3b2vtXvNb1YO/c:NKS/GzLa3/6Svt/NpYS

Score

10^/10

defense_evasion evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe\""	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1596-0-0x0000000000400000-0x000000000045A000-memory.dmp	upx
behavioral2/memory/1596-2-0x0000000000400000-0x000000000045A000-memory.dmp	upx
behavioral2/memory/1596-3-0x0000000000400000-0x000000000045A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
812	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	812	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 812	1596	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe	83
PID 1596 wrote to memory of 812	1596	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe	83
PID 1596 wrote to memory of 812	1596	08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08ae32a82a03c7905b901e1669cd59c4_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Impair Defenses: Safe Mode Boot
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-1-0x00000000006C0000-0x00000000006C2000-memory.dmp

Filesize
8KB

Download
memory/1596-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1596-2-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1596-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads