Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 09:13

General

  • Target

    0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe

  • Size

    224KB

  • MD5

    0d8007c628a5c009d3d2b6aa53e6cc0a

  • SHA1

    3ad7496a74762cae06b394a32dc8832611b20df8

  • SHA256

    d26dc3afdc474fc8170c92fabdab98bf97176635d36fc3a1c8a7f76e77f43b6a

  • SHA512

    6711b4bceda2396f63cc97b26e4884341bca1625a627044ce65195f0d787d8697fb8f550008b5e6ef9771a149aa010d96116dc9cae44728823014f70ec49c596

  • SSDEEP

    3072:1ma9v8Isvh3Tg93yDxkWD8bENk4Dy1lxeMV37q/LwmfYS:Up3Tg93yDxkWD8bERDy8MFq/Ldw

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Document created with cracked Office version 1 IoCs

    Office document contains Grizli777 string known to be caused by using a cracked version of the software.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\Users\Admin\AppData\Local\Temp\rundll32.exe
      "C:\Users\Admin\AppData\Local\Temp\rundll32.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3324
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
          4⤵
          • UAC bypass
          • Modifies registry key
          PID:2712
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SENARAI CALON BN PRU 13.doc" /o ""
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SENARAI CALON BN PRU 13.doc

    Filesize

    82KB

    MD5

    7866ebcba567d0384a4173c44bde6163

    SHA1

    881da445f78b8ba92eddd7eb533dcb0027cd60f4

    SHA256

    ca193036f99a12ed1d89bc434d5b194631f83bc9bd6d4eba92e6403862c800ed

    SHA512

    c3fe4cbb393c72277855f8bbc657bbf6004b462a0ec9b2ca27c2a587055395b890b91a89a543ab33d058d864c636dc196b944ca1668515dd4f9bf2e9e8a4f9b5

  • C:\Users\Admin\AppData\Local\Temp\rundll32.exe

    Filesize

    73KB

    MD5

    716d1b5f9d25d9374208ace7bfda7494

    SHA1

    e27e3c9551952c6b16664138ea6393682161bb51

    SHA256

    2b9fd5444bf32bb57619496751620b6f03d044e6a7d6c1ec734be1dbcbb477e5

    SHA512

    6016aac7c48d7d4a3b322ff77461b229fd6ec2915e4187a0f0259de0cb21446813dfe68d82a7216a21ac28de211e75ff1f0968d3869b0c454c78716cf7d74146

  • memory/1620-32-0x0000000000850000-0x0000000000868000-memory.dmp

    Filesize

    96KB

  • memory/1620-64-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-49-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/1620-46-0x0000000005160000-0x000000000516A000-memory.dmp

    Filesize

    40KB

  • memory/1620-47-0x0000000005450000-0x00000000054A6000-memory.dmp

    Filesize

    344KB

  • memory/1620-40-0x0000000005260000-0x00000000052F2000-memory.dmp

    Filesize

    584KB

  • memory/1620-37-0x0000000005810000-0x0000000005DB4000-memory.dmp

    Filesize

    5.6MB

  • memory/1620-33-0x00000000051C0000-0x000000000525C000-memory.dmp

    Filesize

    624KB

  • memory/2664-30-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

    Filesize

    64KB

  • memory/2664-45-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-29-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

    Filesize

    64KB

  • memory/2664-89-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-85-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

    Filesize

    64KB

  • memory/2664-28-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

    Filesize

    64KB

  • memory/2664-34-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-38-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-39-0x00007FFDC1E80000-0x00007FFDC1E90000-memory.dmp

    Filesize

    64KB

  • memory/2664-26-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-36-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-35-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-24-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

    Filesize

    64KB

  • memory/2664-41-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-42-0x00007FFDC1E80000-0x00007FFDC1E90000-memory.dmp

    Filesize

    64KB

  • memory/2664-43-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-44-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-31-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

    Filesize

    64KB

  • memory/2664-48-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-25-0x00007FFE046ED000-0x00007FFE046EE000-memory.dmp

    Filesize

    4KB

  • memory/2664-86-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

    Filesize

    64KB

  • memory/2664-50-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-87-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

    Filesize

    64KB

  • memory/2664-61-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-62-0x00007FFE046ED000-0x00007FFE046EE000-memory.dmp

    Filesize

    4KB

  • memory/2664-63-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/2664-88-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

    Filesize

    64KB

  • memory/2664-65-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

    Filesize

    2.0MB

  • memory/4060-1-0x000000001B050000-0x000000001B0F6000-memory.dmp

    Filesize

    664KB

  • memory/4060-2-0x00007FFDE6500000-0x00007FFDE6EA1000-memory.dmp

    Filesize

    9.6MB

  • memory/4060-4-0x00007FFDE6500000-0x00007FFDE6EA1000-memory.dmp

    Filesize

    9.6MB

  • memory/4060-27-0x00007FFDE6500000-0x00007FFDE6EA1000-memory.dmp

    Filesize

    9.6MB

  • memory/4060-0-0x00007FFDE67B5000-0x00007FFDE67B6000-memory.dmp

    Filesize

    4KB