abeb9eb3b03565c2de18f1b2130437f51ac96bfb7d6f8325c999a8c0d7696ff5

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe
Size

12KB
MD5

154569e31da077fd46f2399a05d2570b
SHA1

f3a3fedf7945ca362b0f5089fd41e77b9171038d
SHA256

abeb9eb3b03565c2de18f1b2130437f51ac96bfb7d6f8325c999a8c0d7696ff5
SHA512

c57eba2dfdf10a62e984d061f314ae17574d096fb581eeca009eed8df1bad1f03fec4f7e18dd76c6b3d9efe4810ddc26ac95c84081de085d88a64219ae876bcb
SSDEEP

192:8KWaR3rbcwGpeF1k2QjMKhspo5vSMOrh5ObnNie/Kyb21PlM3n+d:NNcwR42K9hspo5BOfObnNiehKNx

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4412-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4412-1-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4412-3-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4412-5-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4412-11-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID	154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl	154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"	154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4412	154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe
4412	154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4404	4412	154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe	100
PID 4412 wrote to memory of 4404	4412	154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe	100
PID 4412 wrote to memory of 4404	4412	154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\154569e31da077fd46f2399a05d2570b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wewt0.bat" "
  2⤵
  PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3668,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wewt0.bat

Filesize
302B

MD5
7c65719b98fa74cab1c871d953b8a1eb

SHA1
bc505456afbf4d196d2f0e64af5d9bb203a15a3b

SHA256
ce7cbe7e9b24c1a7780136087b44ca1ea0079509ea38e87a738788a9cb8ee66b

SHA512
aecf789b99b6913509c33834945db9bb8ca047c63336534efc059739d05b2958c929d462453a6dd61e3d8d9c4bd7a12b462a9ed5d2f69cfa27c9f1ca80d5c8f7

Download Submit
memory/4412-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4412-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4412-3-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4412-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4412-11-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download