93913596742bd8928e1a9a5e4f6e75e070155b3629827fbd43605702ca1e9261

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe
Size

221KB
MD5

3e0dfd74f87f1c3cacb3d52f9ec34e1e
SHA1

34193ae88a3852c8ecbdd6851c4e14b8c4c9df9b
SHA256

93913596742bd8928e1a9a5e4f6e75e070155b3629827fbd43605702ca1e9261
SHA512

2206ae7504531c273b1e4bbaf35a7c9b7a4f4871d273a2605b3353b390dcd54d931b65a6e32867c9ae9934cc2492e2d60c64ffb1c4ad9fede97d6b1ba1594e28
SSDEEP

6144:6f4xe+SJVrL/PL6x8DCH+JigkjBIltvuPSHzC6ynOhTX1In:6Oe+43/2xIJJigk2vvuPAqCTW

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4216-0-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral2/memory/4216-9-0x0000000000400000-0x000000000046F000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lncom_	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lncom.exe	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4216	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3608	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1800	4216	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe	87
PID 4216 wrote to memory of 1800	4216	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe	87
PID 4216 wrote to memory of 1800	4216	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\3E0DFD~1.EXE.bat
  2⤵
  PID:1800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3E0DFD~1.EXE.bat

Filesize
133B

MD5
5943ad25f10950cb01b53fa1099ae9eb

SHA1
c772826ebae5c65c1238ea73b8a7bf8d62d5d5b0

SHA256
5e26f7bdefb98cbde72ffa4f144101b14b81ddefd5c90cde2922a2c619fe93a5

SHA512
852c6d9878baece2429c3cc3f58359ff8b89d5b3f6ee367a16c1ff6ec11b23d6e2791671db59eab6d958197aa38afc653d1be2548b0bc4d26870a05c62ad2d4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118

Filesize
221KB

MD5
87046b46f1392605619e6c6b7605f6e3

SHA1
781053b0aacb132c7919e1b78d931412459639f3

SHA256
57d5d7b54840b8ab678b9650ece1f054d6055b0a6ded7276bdd449319999cff5

SHA512
cbc525c5b2235b413c3530e2cf7d80963ff41a9b47ae91652529ff269983e100a5018854c058c9dafdc99c75316faf47c94c8a1f205d4167f01c842e21f59b85

Download Submit
memory/4216-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4216-9-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download