42b15a5a5819856fd92540d8d199808268bb344ee233f2d7d5a7bb1b4dee5810

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a928620042b1942038b908d4f6c726f_JaffaCakes118.exe
Size

2.8MB
MD5

3a928620042b1942038b908d4f6c726f
SHA1

1f1eb7277af02ea097ec2cbba8c57831fa2f7bd5
SHA256

42b15a5a5819856fd92540d8d199808268bb344ee233f2d7d5a7bb1b4dee5810
SHA512

022e587a286863275a409772584b2bd353d1c654771e8be99a15f9cc0706cd8c1934655446bdf6924adca43803939d973227967944c3c3db60c4b7abdd728456
SSDEEP

49152:SoG9YCLdDZO3nHMAINGRb2M3skZqYXujIrSbfq7L9mLieCzgnGCaU:SpSCpZO3nsVoRbaYXujIeqmL3/nf

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
264	Nelgyar.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysin = "c:\\windows\\system32\\Nelgyar.exe"	reg.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Nelgyar.exe
File opened (read-only)	\??\L:	Nelgyar.exe
File opened (read-only)	\??\M:	Nelgyar.exe
File opened (read-only)	\??\S:	Nelgyar.exe
File opened (read-only)	\??\W:	Nelgyar.exe
File opened (read-only)	\??\B:	Nelgyar.exe
File opened (read-only)	\??\E:	Nelgyar.exe
File opened (read-only)	\??\H:	Nelgyar.exe
File opened (read-only)	\??\P:	Nelgyar.exe
File opened (read-only)	\??\Q:	Nelgyar.exe
File opened (read-only)	\??\X:	Nelgyar.exe
File opened (read-only)	\??\A:	Nelgyar.exe
File opened (read-only)	\??\N:	Nelgyar.exe
File opened (read-only)	\??\T:	Nelgyar.exe
File opened (read-only)	\??\U:	Nelgyar.exe
File opened (read-only)	\??\V:	Nelgyar.exe
File opened (read-only)	\??\Y:	Nelgyar.exe
File opened (read-only)	\??\G:	Nelgyar.exe
File opened (read-only)	\??\I:	Nelgyar.exe
File opened (read-only)	\??\J:	Nelgyar.exe
File opened (read-only)	\??\O:	Nelgyar.exe
File opened (read-only)	\??\R:	Nelgyar.exe
File opened (read-only)	\??\Z:	Nelgyar.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\ra.mp3	cmd.exe
File created	\??\c:\windows\SysWOW64\log.txt	Nelgyar.exe
File created	\??\c:\windows\SysWOW64\ra.txt	Nelgyar.exe
File created	\??\c:\windows\SysWOW64\Nelgyar.exe	cmd.exe
File opened for modification	\??\c:\windows\SysWOW64\Nelgyar.exe	cmd.exe
File created	\??\c:\windows\SysWOW64\ra.mp3	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2304	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	264	Nelgyar.exe
Token: SeCreatePagefilePrivilege	264	Nelgyar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
264	Nelgyar.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2652	2892	3a928620042b1942038b908d4f6c726f_JaffaCakes118.exe	86
PID 2892 wrote to memory of 2652	2892	3a928620042b1942038b908d4f6c726f_JaffaCakes118.exe	86
PID 2892 wrote to memory of 2652	2892	3a928620042b1942038b908d4f6c726f_JaffaCakes118.exe	86
PID 2652 wrote to memory of 264	2652	cmd.exe	88
PID 2652 wrote to memory of 264	2652	cmd.exe	88
PID 2652 wrote to memory of 264	2652	cmd.exe	88
PID 264 wrote to memory of 3044	264	Nelgyar.exe	89
PID 264 wrote to memory of 3044	264	Nelgyar.exe	89
PID 264 wrote to memory of 3044	264	Nelgyar.exe	89
PID 264 wrote to memory of 2536	264	Nelgyar.exe	90
PID 264 wrote to memory of 2536	264	Nelgyar.exe	90
PID 264 wrote to memory of 2536	264	Nelgyar.exe	90
PID 264 wrote to memory of 4640	264	Nelgyar.exe	91
PID 264 wrote to memory of 4640	264	Nelgyar.exe	91
PID 264 wrote to memory of 4640	264	Nelgyar.exe	91
PID 264 wrote to memory of 4244	264	Nelgyar.exe	92
PID 264 wrote to memory of 4244	264	Nelgyar.exe	92
PID 264 wrote to memory of 4244	264	Nelgyar.exe	92
PID 264 wrote to memory of 2148	264	Nelgyar.exe	93
PID 264 wrote to memory of 2148	264	Nelgyar.exe	93
PID 264 wrote to memory of 2148	264	Nelgyar.exe	93
PID 264 wrote to memory of 4020	264	Nelgyar.exe	94
PID 264 wrote to memory of 4020	264	Nelgyar.exe	94
PID 264 wrote to memory of 4020	264	Nelgyar.exe	94
PID 4244 wrote to memory of 3436	4244	cmd.exe	101
PID 4244 wrote to memory of 3436	4244	cmd.exe	101
PID 4244 wrote to memory of 3436	4244	cmd.exe	101
PID 2148 wrote to memory of 4832	2148	cmd.exe	102
PID 2148 wrote to memory of 4832	2148	cmd.exe	102
PID 2148 wrote to memory of 4832	2148	cmd.exe	102
PID 2536 wrote to memory of 2304	2536	cmd.exe	103
PID 2536 wrote to memory of 2304	2536	cmd.exe	103
PID 2536 wrote to memory of 2304	2536	cmd.exe	103
PID 4020 wrote to memory of 2680	4020	cmd.exe	104
PID 4020 wrote to memory of 2680	4020	cmd.exe	104
PID 4020 wrote to memory of 2680	4020	cmd.exe	104
PID 3044 wrote to memory of 2516	3044	cmd.exe	105
PID 3044 wrote to memory of 2516	3044	cmd.exe	105
PID 3044 wrote to memory of 2516	3044	cmd.exe	105
PID 4640 wrote to memory of 3312	4640	cmd.exe	106
PID 4640 wrote to memory of 3312	4640	cmd.exe	106
PID 4640 wrote to memory of 3312	4640	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\3a928620042b1942038b908d4f6c726f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a928620042b1942038b908d4f6c726f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt24808.bat "C:\Users\Admin\AppData\Local\Temp\3a928620042b1942038b908d4f6c726f_JaffaCakes118.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2652
- - \??\c:\windows\SysWOW64\Nelgyar.exe
    c:\windows\system32\Nelgyar.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:264
  - - \??\c:\windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t reg_dword /d 00000001
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t reg_dword /d 00000001
        5⤵
        
        PID:2516
  - - \??\c:\windows\SysWOW64\cmd.exe
      cmd.exe /c REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v sysin /t REG_SZ /d "c:\windows\system32\Nelgyar.exe" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v sysin /t REG_SZ /d "c:\windows\system32\Nelgyar.exe" /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2304
  - - \??\c:\windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden t reg_dword /d 00000000 /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden t reg_dword /d 00000000 /F
        5⤵
        
        PID:3312
  - - \??\c:\windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t reg_dword /d 00000001 /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t reg_dword /d 00000001 /F
        5⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3436
  - - \??\c:\windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v SuperHidden /t reg_dword /d 00000001 /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v SuperHidden /t reg_dword /d 00000001 /F
        5⤵
        
        PID:4832
  - - \??\c:\windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /t reg_dword /d 00000000 /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4020
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /t reg_dword /d 00000000 /F
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        
        PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Nelgyar.exe

Filesize
264KB

MD5
00a40c808fc6f1bd6435cd27cac2a60c

SHA1
266d557ab6df4adb9c2175986a2b3f0b5ab88e66

SHA256
e3c303be55da02c13e0c90090ff13b8fd8a8c08a0b2146123da76a0d61fc9a37

SHA512
9e5b2aa293a70ea4002c0d3b5a26d2c92ef3ec1205d7232e35a2db2d9c7ee0bc2e8e4e02952d915577571d34f490cd7f722a13e6ce74b98f7a46649f6babf329

Download Submit
C:\Users\Admin\AppData\Local\Temp\bt24808.bat

Filesize
183B

MD5
ff853b60408d5010d17591eca7c1e38f

SHA1
ffa1c4ee4d7bf5da2418716d61b0e8d26beac8c2

SHA256
33892921cdd34e78e3f089107b0766be3ce764d6bdd674d6778560baaeb70780

SHA512
a71c5efa534c9bdab36f569929c34a750b9aee29db09bbb4ee5bcac2364b86721143fdbcb9753d032b9ae32d66a6ab982f28f9645d2888118c965e55a8d655b8

Download Submit
C:\Users\Admin\AppData\Local\ra.mp3

Filesize
2.7MB

MD5
227e2e865aaaab7d2b9fbda7522bb416

SHA1
ebf006ff440241d11390d98d1c3027130c649bb5

SHA256
ce46f2b02e4f2774ef7fcd25c48bb70b894e53e4dd7b0b9e8113db90279494bd

SHA512
6104dbcd8418aa32399bc9ffd60514f4b5385bd957c9fb8062f01f741587140062b323cd14f192574e9b3e3a99cbcf2f8224833904783c08c055375baedb4d21

Download Submit
memory/2892-29-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads