600f0c7f3065a243989f6ce276bc0599e65163b88cc1ec3ae1fd64cf7f713b9d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

489969040de8996c10112600b5af0102_JaffaCakes118.exe
Size

624KB
MD5

489969040de8996c10112600b5af0102
SHA1

b84cb222f0f228f735bda64c222b6b1f4ad20a6a
SHA256

600f0c7f3065a243989f6ce276bc0599e65163b88cc1ec3ae1fd64cf7f713b9d
SHA512

df9526d91b4df620440377a2249f364f2409766266884b629530de2c0dab62e1b1c2ef27f4565b00c4c23629cb3e50abc44b643f34e34754376f80e955824c75
SSDEEP

6144:q8WuvadI/lk4MGw2uTniKCcpOHykxJyjGvj3T:qJuOI9TpnGiK5OHtxd

Score

8^/10

evasion execution persistence

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	489969040de8996c10112600b5af0102_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4416	Q.exe
1564	app.exe

Loads dropped DLL 1 IoCs

pid	Process
1564	app.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bak8011252.log	Q.exe

Boot or Logon Autostart Execution: Time Providers 1 TTPs 4 IoCs

The Windows Time service (W32Time) enables time synchronization across and within domains.

persistence

Time Providers

T1547.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\285\InputProvider = "1"	Q.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\285	Q.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\285\DllName = "C:\\gvmdsj\\5m_7J.aaA"	Q.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\285\Enabled = "1"	Q.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2152	sc.exe
4476	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7C9975-ECA1-4190-B0EB-E37BC5E40893}\LocalServer32	app.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7C9975-ECA1-4190-B0EB-E37BC5E40893}\LocalServer32\ = "="	app.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	app.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\	app.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	app.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\	app.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7C9975-ECA1-4190-B0EB-E37BC5E40893}	app.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7C9975-ECA1-4190-B0EB-E37BC5E40893}\	app.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4416	Q.exe
4416	Q.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe
1564	app.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 4416	3860	489969040de8996c10112600b5af0102_JaffaCakes118.exe	88
PID 3860 wrote to memory of 4416	3860	489969040de8996c10112600b5af0102_JaffaCakes118.exe	88
PID 3860 wrote to memory of 4416	3860	489969040de8996c10112600b5af0102_JaffaCakes118.exe	88
PID 4416 wrote to memory of 2152	4416	Q.exe	91
PID 4416 wrote to memory of 2152	4416	Q.exe	91
PID 4416 wrote to memory of 2152	4416	Q.exe	91
PID 4416 wrote to memory of 4476	4416	Q.exe	93
PID 4416 wrote to memory of 4476	4416	Q.exe	93
PID 4416 wrote to memory of 4476	4416	Q.exe	93
PID 4416 wrote to memory of 5020	4416	Q.exe	94
PID 4416 wrote to memory of 5020	4416	Q.exe	94
PID 4416 wrote to memory of 5020	4416	Q.exe	94
PID 4416 wrote to memory of 1564	4416	Q.exe	96
PID 4416 wrote to memory of 1564	4416	Q.exe	96
PID 4416 wrote to memory of 1564	4416	Q.exe	96
PID 5020 wrote to memory of 4924	5020	net.exe	98
PID 5020 wrote to memory of 4924	5020	net.exe	98
PID 5020 wrote to memory of 4924	5020	net.exe	98

C:\Users\Admin\AppData\Local\Temp\489969040de8996c10112600b5af0102_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\489969040de8996c10112600b5af0102_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Users\Admin\AppData\Local\Temp\Q.exe
  "C:\Users\Admin\AppData\Local\Temp\Q.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Boot or Logon Autostart Execution: Time Providers
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\sc.exe
    sc stop w32time
    3⤵
    - Launches sc.exe
    PID:2152
- - C:\Windows\SysWOW64\sc.exe
    sc config w32time start= auto
    3⤵
    - Launches sc.exe
    PID:4476
- - C:\Windows\SysWOW64\net.exe
    net start w32time
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      PID:4924
- - C:\gvmdsj\app.exe
    C:\gvmdsj\app.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Time Providers

T1547.003

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Time Providers

T1547.003

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\bak8011252.log

Filesize
39B

MD5
8ec5e9c5b7ec787f5606b657c8978a07

SHA1
5dc17dfc496ae6ca915f8a4d179c899c8e41dbe8

SHA256
c1c4552850a26cc53eccd659cfcd4fc3627b0b1dd677d0040e2d16ca5405d579

SHA512
8ac9ac25aad558590e1a6c8a97f1c429b9fc38836ddb6428c9e1e0a8985ffe8f81b85e3ae84898bae344587a187d136eeb01337d3d17166cab81ef5571f0a4d2

Download Submit
C:\gvmdsj\app.exe

Filesize
15KB

MD5
c8c7f7472e5c059cbcc99d1eedd0d1ae

SHA1
10013a17639887f8c8ee2b37ec111352b9102832

SHA256
066bd9a9e327df4422beb4922e49be328db8adc1b7c6fad7e4b5f1c47c5655c9

SHA512
82762abeade3df840095f95f0559a1a6164e62bae3ff74e547df22dc59034b3ac65a540065aba2434798a6d3a8915ac455d564e0ab885333601fffa32e3272d0

Download Submit
memory/4416-10-0x0000000000400000-0x0000000005756000-memory.dmp

Filesize
83.3MB

Download
memory/4416-24-0x0000000000400000-0x0000000005756000-memory.dmp

Filesize
83.3MB

Download