273b418e9c1e98740d63b8d6e9714b7d74184a40bba4440dd904a083932e568b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe
Size

90KB
MD5

6265f6f4cd06f58926abe69cc681c50e
SHA1

3736f3d34b566b55767789b9d3f287aa077963bf
SHA256

273b418e9c1e98740d63b8d6e9714b7d74184a40bba4440dd904a083932e568b
SHA512

7a31b7bbf3966e4170f1c6a6c67b1a676258399fa606a775afa4bc9dff90cfa1340694bbe8af698ed58f3ea658ca018581ab22ba9c5a4d7b0b1e4cee8ccb0d20
SSDEEP

1536:6PvinDRszwT6H8p8Zzxg9NtxTBq2euS9ZyyN4tzi157Prr6prc+nlt:xDCzEngziFIMS9IG4tzi157Prr6prc+3

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bcndl.lnk	WScript.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1680-0-0x0000000000400000-0x000000000042E600-memory.dmp	upx
behavioral2/memory/1680-7-0x0000000000400000-0x000000000042E600-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1680 set thread context of 3056	1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3056	1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	84
PID 1680 wrote to memory of 3056	1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	84
PID 1680 wrote to memory of 3056	1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	84
PID 1680 wrote to memory of 3056	1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	84
PID 1680 wrote to memory of 3056	1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	84
PID 1680 wrote to memory of 3056	1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	84
PID 1680 wrote to memory of 3056	1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	84
PID 1680 wrote to memory of 3056	1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	84
PID 1680 wrote to memory of 3056	1680	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	84
PID 3056 wrote to memory of 4132	3056	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	87
PID 3056 wrote to memory of 4132	3056	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	87
PID 3056 wrote to memory of 4132	3056	6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6265f6f4cd06f58926abe69cc681c50e_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\znais.vbs"
    3⤵
    - Drops startup file
    PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\znais.vbs

Filesize
5KB

MD5
10e64135d55a29a4bd6b7a7804704065

SHA1
1b961bed9e0a6f8a48834a2b377bfe11500c85a5

SHA256
b616e09502f88f70d8be173a50a60edf99b7e4ca95e495a5c845212d9a2ead5a

SHA512
1aa1f9c20ae4537aea17f792bb26687d204f47763a6b78cdb725921fc05e003e08e25687c04c6217ca0815786b480f9e73bc163036dff2bcb5410f522331d48d

Download Submit
memory/1680-0-0x0000000000400000-0x000000000042E600-memory.dmp

Filesize
185KB

Download
memory/1680-7-0x0000000000400000-0x000000000042E600-memory.dmp

Filesize
185KB

Download
memory/3056-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3056-5-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3056-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download