d7dc82cf8b2974b6b7f7281146cedf194da7a7e62b334451e462cfe523782382

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe
Size

156KB
MD5

21929c467ce65e655dd1e1311c4089f3
SHA1

aacfc2694ab925a8fedef816256430f793003207
SHA256

d7dc82cf8b2974b6b7f7281146cedf194da7a7e62b334451e462cfe523782382
SHA512

615cd802d0d7435a63e68543af12554939f452eab5a4e80b8a25e689ec3714fb21835eb506fb2ab81d912e7f4cd266a29d14aa7ebe35947ffff946eae7db8d48
SSDEEP

3072:KszVcfQEoDtbOJc5AEPKhmm2jsm/95yOxeWVD:Ksg7Ob5AEPI52gm/95yXWVD

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4672	svchost.exe
2764	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\svchost.exe"	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 4672 set thread context of 2764	4672	svchost.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 2416 wrote to memory of 1564	2416	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	80
PID 1564 wrote to memory of 4672	1564	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	81
PID 1564 wrote to memory of 4672	1564	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	81
PID 1564 wrote to memory of 4672	1564	21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe	81
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82
PID 4672 wrote to memory of 2764	4672	svchost.exe	82

C:\Users\Admin\AppData\Local\Temp\21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\21929c467ce65e655dd1e1311c4089f3_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Users\Admin\AppData\Local\Microsoft\svchost.exe
    "C:\Users\Admin\AppData\Local\Microsoft\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Users\Admin\AppData\Local\Microsoft\svchost.exe
      "C:\Users\Admin\AppData\Local\Microsoft\svchost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\svchost.exe

Filesize
156KB

MD5
21929c467ce65e655dd1e1311c4089f3

SHA1
aacfc2694ab925a8fedef816256430f793003207

SHA256
d7dc82cf8b2974b6b7f7281146cedf194da7a7e62b334451e462cfe523782382

SHA512
615cd802d0d7435a63e68543af12554939f452eab5a4e80b8a25e689ec3714fb21835eb506fb2ab81d912e7f4cd266a29d14aa7ebe35947ffff946eae7db8d48

Download Submit
memory/1564-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1564-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1564-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1564-5-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2764-70-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2764-71-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads