70b4f96142dff1ee461be631ac40e1ded2b425dd1223d2e1d7f89f6513ca7372

Analysis

max time kernel
149s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3de39d311293a9cdbef5e557b92ddf61_JaffaCakes118.exe
Size

387KB
MD5

3de39d311293a9cdbef5e557b92ddf61
SHA1

9bc9f526f22861325ef6aa558db2ef16ef6a9cbc
SHA256

70b4f96142dff1ee461be631ac40e1ded2b425dd1223d2e1d7f89f6513ca7372
SHA512

e5b79492f8dacc82acdfaeb753baefb8235ec9e067a080840f92abb874608ecc6421625768588b4cfbf997e9eefb0ee5f3a429da3db7c84ccf002ecb25da3227
SSDEEP

6144:I9TMlSVMM9TOEvtruUnIKvS+eWjpMSRjiQgSsDlS+jlS:IhnHhBt6UnIceEs

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	3de39d311293a9cdbef5e557b92ddf61_JaffaCakes118.exe

Executes dropped EXE 23 IoCs

pid	Process
1628	install_flash_player.exe
3776	Beaver's E-Mail Bomber.exe
1488	install_flash_player.exe
744	wuamgard.exe
3536	wuamgard.exe
4548	wuamgard.exe
2724	wuamgard.exe
2552	wuamgard.exe
3684	wuamgard.exe
3480	wuamgard.exe
3308	wuamgard.exe
3392	wuamgard.exe
2736	wuamgard.exe
4332	wuamgard.exe
4308	wuamgard.exe
5068	wuamgard.exe
2488	wuamgard.exe
3756	wuamgard.exe
4292	wuamgard.exe
1936	wuamgard.exe
3696	wuamgard.exe
5028	wuamgard.exe
1384	wuamgard.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	install_flash_player.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	install_flash_player.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File created	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe
File opened for modification	C:\Windows\SysWOW64\wuamgard.exe	wuamgard.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 1488	1628	install_flash_player.exe	87
PID 744 set thread context of 3536	744	wuamgard.exe	90
PID 4548 set thread context of 2724	4548	wuamgard.exe	92
PID 2552 set thread context of 3684	2552	wuamgard.exe	96
PID 3480 set thread context of 3308	3480	wuamgard.exe	100
PID 3392 set thread context of 2736	3392	wuamgard.exe	102
PID 4332 set thread context of 4308	4332	wuamgard.exe	104
PID 5068 set thread context of 2488	5068	wuamgard.exe	106
PID 3756 set thread context of 4292	3756	wuamgard.exe	108
PID 1936 set thread context of 3696	1936	wuamgard.exe	110
PID 5028 set thread context of 1384	5028	wuamgard.exe	112

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 1628	556	3de39d311293a9cdbef5e557b92ddf61_JaffaCakes118.exe	85
PID 556 wrote to memory of 1628	556	3de39d311293a9cdbef5e557b92ddf61_JaffaCakes118.exe	85
PID 556 wrote to memory of 1628	556	3de39d311293a9cdbef5e557b92ddf61_JaffaCakes118.exe	85
PID 556 wrote to memory of 3776	556	3de39d311293a9cdbef5e557b92ddf61_JaffaCakes118.exe	86
PID 556 wrote to memory of 3776	556	3de39d311293a9cdbef5e557b92ddf61_JaffaCakes118.exe	86
PID 1628 wrote to memory of 1488	1628	install_flash_player.exe	87
PID 1628 wrote to memory of 1488	1628	install_flash_player.exe	87
PID 1628 wrote to memory of 1488	1628	install_flash_player.exe	87
PID 1628 wrote to memory of 1488	1628	install_flash_player.exe	87
PID 1628 wrote to memory of 1488	1628	install_flash_player.exe	87
PID 1488 wrote to memory of 744	1488	install_flash_player.exe	89
PID 1488 wrote to memory of 744	1488	install_flash_player.exe	89
PID 1488 wrote to memory of 744	1488	install_flash_player.exe	89
PID 744 wrote to memory of 3536	744	wuamgard.exe	90
PID 744 wrote to memory of 3536	744	wuamgard.exe	90
PID 744 wrote to memory of 3536	744	wuamgard.exe	90
PID 744 wrote to memory of 3536	744	wuamgard.exe	90
PID 744 wrote to memory of 3536	744	wuamgard.exe	90
PID 3536 wrote to memory of 4548	3536	wuamgard.exe	91
PID 3536 wrote to memory of 4548	3536	wuamgard.exe	91
PID 3536 wrote to memory of 4548	3536	wuamgard.exe	91
PID 4548 wrote to memory of 2724	4548	wuamgard.exe	92
PID 4548 wrote to memory of 2724	4548	wuamgard.exe	92
PID 4548 wrote to memory of 2724	4548	wuamgard.exe	92
PID 4548 wrote to memory of 2724	4548	wuamgard.exe	92
PID 4548 wrote to memory of 2724	4548	wuamgard.exe	92
PID 2724 wrote to memory of 2552	2724	wuamgard.exe	95
PID 2724 wrote to memory of 2552	2724	wuamgard.exe	95
PID 2724 wrote to memory of 2552	2724	wuamgard.exe	95
PID 2552 wrote to memory of 3684	2552	wuamgard.exe	96
PID 2552 wrote to memory of 3684	2552	wuamgard.exe	96
PID 2552 wrote to memory of 3684	2552	wuamgard.exe	96
PID 2552 wrote to memory of 3684	2552	wuamgard.exe	96
PID 2552 wrote to memory of 3684	2552	wuamgard.exe	96
PID 3684 wrote to memory of 3480	3684	wuamgard.exe	99
PID 3684 wrote to memory of 3480	3684	wuamgard.exe	99
PID 3684 wrote to memory of 3480	3684	wuamgard.exe	99
PID 3480 wrote to memory of 3308	3480	wuamgard.exe	100
PID 3480 wrote to memory of 3308	3480	wuamgard.exe	100
PID 3480 wrote to memory of 3308	3480	wuamgard.exe	100
PID 3480 wrote to memory of 3308	3480	wuamgard.exe	100
PID 3480 wrote to memory of 3308	3480	wuamgard.exe	100
PID 3308 wrote to memory of 3392	3308	wuamgard.exe	101
PID 3308 wrote to memory of 3392	3308	wuamgard.exe	101
PID 3308 wrote to memory of 3392	3308	wuamgard.exe	101
PID 3392 wrote to memory of 2736	3392	wuamgard.exe	102
PID 3392 wrote to memory of 2736	3392	wuamgard.exe	102
PID 3392 wrote to memory of 2736	3392	wuamgard.exe	102
PID 3392 wrote to memory of 2736	3392	wuamgard.exe	102
PID 3392 wrote to memory of 2736	3392	wuamgard.exe	102
PID 2736 wrote to memory of 4332	2736	wuamgard.exe	103
PID 2736 wrote to memory of 4332	2736	wuamgard.exe	103
PID 2736 wrote to memory of 4332	2736	wuamgard.exe	103
PID 4332 wrote to memory of 4308	4332	wuamgard.exe	104
PID 4332 wrote to memory of 4308	4332	wuamgard.exe	104
PID 4332 wrote to memory of 4308	4332	wuamgard.exe	104
PID 4332 wrote to memory of 4308	4332	wuamgard.exe	104
PID 4332 wrote to memory of 4308	4332	wuamgard.exe	104
PID 4308 wrote to memory of 5068	4308	wuamgard.exe	105
PID 4308 wrote to memory of 5068	4308	wuamgard.exe	105
PID 4308 wrote to memory of 5068	4308	wuamgard.exe	105
PID 5068 wrote to memory of 2488	5068	wuamgard.exe	106
PID 5068 wrote to memory of 2488	5068	wuamgard.exe	106
PID 5068 wrote to memory of 2488	5068	wuamgard.exe	106

C:\Users\Admin\AppData\Local\Temp\3de39d311293a9cdbef5e557b92ddf61_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3de39d311293a9cdbef5e557b92ddf61_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\install_flash_player.exe
  "C:\Users\Admin\AppData\Local\Temp\install_flash_player.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\install_flash_player.exe
    C:\Users\Admin\AppData\Local\Temp\install_flash_player.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\SysWOW64\wuamgard.exe
      C:\Windows\system32\wuamgard.exe 1000 "C:\Users\Admin\AppData\Local\Temp\install_flash_player.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:744
    - - C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\SysWOW64\wuamgard.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3536
      - C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\system32\wuamgard.exe 1148 "C:\Windows\SysWOW64\wuamgard.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\SysWOW64\wuamgard.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\system32\wuamgard.exe 1120 "C:\Windows\SysWOW64\wuamgard.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\SysWOW64\wuamgard.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\system32\wuamgard.exe 1120 "C:\Windows\SysWOW64\wuamgard.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\SysWOW64\wuamgard.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\system32\wuamgard.exe 1124 "C:\Windows\SysWOW64\wuamgard.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\SysWOW64\wuamgard.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\system32\wuamgard.exe 1120 "C:\Windows\SysWOW64\wuamgard.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\SysWOW64\wuamgard.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\system32\wuamgard.exe 1120 "C:\Windows\SysWOW64\wuamgard.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\SysWOW64\wuamgard.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2488
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\system32\wuamgard.exe 1124 "C:\Windows\SysWOW64\wuamgard.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3756
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\SysWOW64\wuamgard.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4292
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\system32\wuamgard.exe 1120 "C:\Windows\SysWOW64\wuamgard.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1936
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\SysWOW64\wuamgard.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3696
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\system32\wuamgard.exe 1120 "C:\Windows\SysWOW64\wuamgard.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5028
        
        C:\Windows\SysWOW64\wuamgard.exe
        
        C:\Windows\SysWOW64\wuamgard.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1384
- C:\Users\Admin\AppData\Local\Temp\Beaver's E-Mail Bomber.exe
  "C:\Users\Admin\AppData\Local\Temp\Beaver's E-Mail Bomber.exe"
  2⤵
  - Executes dropped EXE
  PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Beaver's E-Mail Bomber.exe

Filesize
94KB

MD5
b03e54a8188aac4c75915ab44550c033

SHA1
e4362465e02be15c7d7a806205f3b12f94208eda

SHA256
109c443308f6732ab7debeb21052df4ac211149edc9f7c434e06c78640c2ebd5

SHA512
91d22bbdd9bd2a58f8169aa2b70287e5603a5fdfee78b19dbb5139b3219da9aed0b4bd1ea14cf96b89cb6560dac243fd1e71e6aefe5f13c3db1b3b6236dc8dc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\install_flash_player.exe

Filesize
231KB

MD5
9955cb328648677787bfabf1b953f508

SHA1
b67d75492b84980fc3acbe651b142fb63b9a2f3b

SHA256
9089e1b8ed19287d3a84610760c62ad63bbf5becbf4ea3e6e70934725d00cccf

SHA512
8aa1087adf3953394eb57082e77e65cf425663b9df26bf612f40ea3c78dcdf6080b5608f82a11f1afeaf1fbd2f0f736b49176a33b646373efc8cc516fe39fb77

Download Submit
memory/1384-109-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1488-22-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1488-23-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1488-19-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1488-40-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2488-88-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2724-53-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2736-74-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3308-67-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3536-44-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3684-60-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3696-102-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3776-26-0x000000001B8B0000-0x000000001B956000-memory.dmp

Filesize
664KB

Download
memory/3776-51-0x00007FFC73D55000-0x00007FFC73D56000-memory.dmp

Filesize
4KB

Download
memory/3776-52-0x00007FFC73AA0000-0x00007FFC74441000-memory.dmp

Filesize
9.6MB

Download
memory/3776-43-0x000000001C4E0000-0x000000001C52C000-memory.dmp

Filesize
304KB

Download
memory/3776-42-0x0000000001100000-0x0000000001108000-memory.dmp

Filesize
32KB

Download
memory/3776-41-0x000000001C400000-0x000000001C49C000-memory.dmp

Filesize
624KB

Download
memory/3776-37-0x000000001BF30000-0x000000001C3FE000-memory.dmp

Filesize
4.8MB

Download
memory/3776-33-0x00007FFC73AA0000-0x00007FFC74441000-memory.dmp

Filesize
9.6MB

Download
memory/3776-30-0x00007FFC73AA0000-0x00007FFC74441000-memory.dmp

Filesize
9.6MB

Download
memory/3776-24-0x00007FFC73D55000-0x00007FFC73D56000-memory.dmp

Filesize
4KB

Download
memory/4292-95-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4308-81-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download