0592fd7640b20937bb288c44e06d924daa1e3397f55b54440a7c12e7979d8e48

Analysis

max time kernel
136s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fdf328426ecf86ef63b76949fd208fc_JaffaCakes118.exe
Size 598KB
Sample240625-25grdssamr
SHA256 0592fd7640b20937bb288c44e06d924daa1e3397f55b54440a7c12e7979d8e48
MD5 0fdf328426ecf86ef63b76949fd208fc
SHA1 4e1c12e0108a6e82ab112e618cd1cde5eb04cbf2
SHA512 4b669582aece23c54c95b3cb5e4f077849e13e4b2aff323a010fa4f0a7aa0d025feadeb76385857a0269c5730877ccc3cdbec529d2fad915efcedea013871f08
SSDEEP 6144:twwD6UiF6ojFnFeVZLHrwwDgUiF6ojFnFeVZL8+nOj0FZOUxku0GzTVowvYy:mC44UefsCu4UefFVXTmRy
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	REG.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	server.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	0fdf328426ecf86ef63b76949fd208fc_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1552	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\server.exe = "C:\\Program Files"	server.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	server.exe
File opened for modification	C:\autorun.inf	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
940	REG.exe
3632	REG.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1552	server.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1552	server.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1552	4968	0fdf328426ecf86ef63b76949fd208fc_JaffaCakes118.exe	80
PID 4968 wrote to memory of 1552	4968	0fdf328426ecf86ef63b76949fd208fc_JaffaCakes118.exe	80
PID 4968 wrote to memory of 1552	4968	0fdf328426ecf86ef63b76949fd208fc_JaffaCakes118.exe	80
PID 1552 wrote to memory of 3632	1552	server.exe	81
PID 1552 wrote to memory of 3632	1552	server.exe	81
PID 1552 wrote to memory of 3632	1552	server.exe	81
PID 1552 wrote to memory of 940	1552	server.exe	82
PID 1552 wrote to memory of 940	1552	server.exe	82
PID 1552 wrote to memory of 940	1552	server.exe	82

C:\Users\Admin\AppData\Local\Temp\0fdf328426ecf86ef63b76949fd208fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fdf328426ecf86ef63b76949fd208fc_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    - Modifies registry key
    PID:3632
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 173KB
SHA256 f62a1a51e02d31e99b7cf2612067e7f16070ef6877cbd5bd1dd18108bb3c9250
MD5 268bdd9f14e2b1934b7a1125b35e74fe
SHA1 aceda13e816b22bc199aeb222936985d7a8ee019
SHA512 4b2c5b213bba1b169b8de4cf36f733ca4ab4640d7323b0057a5d6b92001e45456d36d773e757ee37d8c9d86040999f461f539790c4f4135cf317a45aa44c6ade
SSDEEP 3072:J18jboFnSjYW4scOUxALupWGjolObTVtgK:JOj0FZOUxku0GzTV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

4233386.jpg

Path C:\Users\Admin\AppData\Local\Temp\temples32\ekran\4233386.jpg
Size 74KB
SHA256 12b8dde71c27d811afb94919f8132e35edc90397b9f1844aaf3c74c48bdc42b5
MD5 45b118d5fbe98b7b5e6f760ae1bef1b4
SHA1 85282041fd35f46ff7049173e254da6c397d3c0d
SHA512 398ffdf3367d950c8ccc54b4a557439f26de4a72b761653b159eacbeb43d91803550b8983322bdde68c764521a10066733df7a1b589783ccb7ca0d9d90ff3e8b
SSDEEP 1536:sm37kpU9rugVIg+4H7kjIy8+6DhM8DVdAMLQCl/UJODw:fqUIgVV+ACIB+k/oAHl/pDw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1552-27-0x0000000074E70000-0x0000000075421000-memory.dmp

Download

memory/1552-15-0x0000000074E70000-0x0000000075421000-memory.dmp

Download

memory/1552-17-0x0000000074E70000-0x0000000075421000-memory.dmp

Download

memory/1552-19-0x0000000074E70000-0x0000000075421000-memory.dmp

Download

memory/1552-26-0x0000000074E70000-0x0000000075421000-memory.dmp

Download

memory/1552-28-0x0000000074E70000-0x0000000075421000-memory.dmp

Download

memory/1552-29-0x0000000074E70000-0x0000000075421000-memory.dmp

Download

memory/4968-2-0x0000000074E70000-0x0000000075421000-memory.dmp

Download

memory/4968-18-0x0000000074E70000-0x0000000075421000-memory.dmp

Download

memory/4968-0-0x0000000074E72000-0x0000000074E73000-memory.dmp

Download

memory/4968-1-0x0000000074E70000-0x0000000075421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads