2dd819d9bb06cb8ce4684d55bc6a8b9d2681511827437faa4eebc1d81b60e529

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe
Size 78KB
Sample240708-tmxe5axbpl
SHA256 2dd819d9bb06cb8ce4684d55bc6a8b9d2681511827437faa4eebc1d81b60e529
MD5 2cf9f4af6387da60b312d05cc32f5421
SHA1 7e4650734d8491160a85afea52c06e11e1034ce8
SHA512 99f6bc830cd177bb39d5414d6dea0948baa2d3af2207667aef45a046b5cc736ad3a2872e58334676662871a8cf3a0eac31c877f0643fbaad1d5f2c5a67a4514a
SSDEEP 1536:yRWtHF3M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQte6o9/ys1Ru:yRWtHF8hASyRxvhTzXPvCbW2Ue6o9/6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Control Panel\International\Geo\Nation	2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3560	tmpBD93.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmpBD93.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe
Token: SeDebugPrivilege	3560	tmpBD93.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 1244	4484	2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe	84
PID 4484 wrote to memory of 1244	4484	2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe	84
PID 4484 wrote to memory of 1244	4484	2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe	84
PID 1244 wrote to memory of 2984	1244	vbc.exe	87
PID 1244 wrote to memory of 2984	1244	vbc.exe	87
PID 1244 wrote to memory of 2984	1244	vbc.exe	87
PID 4484 wrote to memory of 3560	4484	2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe	88
PID 4484 wrote to memory of 3560	4484	2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe	88
PID 4484 wrote to memory of 3560	4484	2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\as--jhtj.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBEFA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4A244E216EF74157AB4EEBA6DAB3A.TMP"
    3⤵
    PID:2984
- C:\Users\Admin\AppData\Local\Temp\tmpBD93.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpBD93.tmp.exe" C:\Users\Admin\AppData\Local\Temp\2cf9f4af6387da60b312d05cc32f5421_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESBEFA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBEFA.tmp
Size 1KB
SHA256 20f6aad2ff76ce847af033e57f2777047e2e1685e5924d846fed86a996b2e164
MD5 81a92fad0e1493eaa81dd45905da0986
SHA1 10b442d6e33f764773e1ba32acff2011ffa25cae
SHA512 1eb1ab4e3a7ac88f5f562a77b4538bc65b5dbc84b0717494af11b2622e6246de3494d28159d9bc0d2ef8636b072b7e0215c66017cd714c6a313180a8652ed053
MD5 SHA1 SHA512

Submit Download

as--jhtj.0.vb

Path C:\Users\Admin\AppData\Local\Temp\as--jhtj.0.vb
Size 15KB
SHA256 b43fab25c22c79e68f49f9f61be8ad5e7d1be945242ad4697dc8f4c96525de94
MD5 d702f6867bb2af3df3f94d4d4e2befcd
SHA1 59324284a766f5313d285faa01f4565dd7e6bb4e
SHA512 a8fc5b0c5ac799aeeacba52be230546869c64a7039173cea887595e003a315873b36e0690f2fd292746d022656d506cddfd40e8e78a84f110d4c38c1eaee856e
SSDEEP 384:r2LiNNAcNiNqnENXXSgPWMI+NZ/NDcHbqE6NtGzN7QiSN7eP:CL0A8uqnkXCgPWHyZFDcH6tGhr+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

as--jhtj.cmdline

Path C:\Users\Admin\AppData\Local\Temp\as--jhtj.cmdline
Size 266B
SHA256 6171925e5f6eb3cf79a8eed504b5e270bfdc1a1ac56e407df29068ae435a5128
MD5 00344f5db0e26df81141bbb830f13d01
SHA1 6e7bab8cee592073fcaa3e5e84c2f21413f6bf3f
SHA512 ffa169d1b4c4ded0810cb95dd8607d9aee8d31a807a2065bc615f2b33922b12fd5fb2a148a216b8aa5734da751ebf6a5b6202daa2500f973743bed03df251d75
MD5 SHA1 SHA512

Submit Download

tmpBD93.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpBD93.tmp.exe
Size 78KB
SHA256 d304c6d2faa9ee5c0315611bc6c6a0b1e7d74f13cc8ce7861a220ddb48c47a34
MD5 260f1254524b4c9b288090baf80aa5b9
SHA1 abad5ce6a9791580a56bc253e1f8da5ef49e633f
SHA512 c170b32c5c9fac7a555c4fcbd645e50bff456e63c9f2986ee8d9d2b4be796226891ac27edfff4df9a7db546a2f7230da6107655e07afc5751ecebbf5f036d0f4
SSDEEP 1536:E4V53XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6Ba9/AZ1rH:E4V5nSyRxvhTzXPvCbW2Upa9/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc4A244E216EF74157AB4EEBA6DAB3A.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc4A244E216EF74157AB4EEBA6DAB3A.TMP
Size 660B
SHA256 22bd31167e5c68999eeb6ac66d1d9e966fa1b06550e5d714e1707bf957b704b2
MD5 cb1dde738c5be883387156eecfb6b91c
SHA1 4fe0b2b474e11b12fbe0d10cd6d46f15df90a0b1
SHA512 dbb6b723efad245b50f51244a4eed7a36daa5a5660142330f2c52229f8d2e86bcad32075a6f484a8162cc508a9933824299e2c81be4f2015ea3562d2ba5879ad
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1244-9-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/1244-18-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/3560-23-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/3560-24-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/3560-25-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/3560-27-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/3560-28-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/3560-29-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/4484-22-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/4484-1-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/4484-2-0x0000000075060000-0x0000000075611000-memory.dmp

Download

memory/4484-0-0x0000000075062000-0x0000000075063000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads