4353946db1b75a44665f1d5b31ee8b8d22a244c1b3ff883bb5b8f721c6bf8d07

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
Size

11KB
MD5

345594d950e75ee803712a800a2fd228
SHA1

d61a9e0b899ae54340028e274a200e36c9ee8484
SHA256

4353946db1b75a44665f1d5b31ee8b8d22a244c1b3ff883bb5b8f721c6bf8d07
SHA512

3bd474bb74bcb3f7f4c9854401acb9a9b4aeda1956cac5fda3a0baa219dbbec2acc793d129f02367b47ba655ac7bdfd9eed0319c5afe67775c8dafbd7792af5d
SSDEEP

192:bl8ar7TJjaROkOEGELOGHcR3TInOibY+5fbw3uz3GuyvPZxQTGqap:bl70JGMFnOibJVcQ3Kn0TrY

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\kernel32.dll = "C:\\Windows\\SysWOW64\\isnotify.exe"	isnotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run	isnotify.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4252	isnotify.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\isnotify.exe	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4252	4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	83
PID 4044 wrote to memory of 4252	4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	83
PID 4044 wrote to memory of 4252	4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	83
PID 4044 wrote to memory of 2832	4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	85
PID 4044 wrote to memory of 2832	4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	85
PID 4044 wrote to memory of 2832	4044	345594d950e75ee803712a800a2fd228_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\345594d950e75ee803712a800a2fd228_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\345594d950e75ee803712a800a2fd228_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\isnotify.exe
  C:\Windows\system32\isnotify.exe
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\345594~1.EXE > nul
  2⤵
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\isnotify.exe

Filesize
8KB

MD5
61289ef1f8837e03d5f48ec25b403b90

SHA1
eae8d5dfa66b02bd331d78b7b9a8734cebbbfe2f

SHA256
e812ab2c605faf7992171726baf6c0798a23d0205d4b660282399b5013c357c4

SHA512
c3046e2a5a2925b9104430e430dbe5da75e9efc22099a03117c688cb88783ef229f29917b95003c062674af9f1b07b5663168f4444ab97791b0914003dc9bae2

Download Submit