462c3f8b6934e5dae42edff0aa78ea8fca41d85d5b4f54a3bb82e3f8cebb7b01

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe
Size

52KB
MD5

674e564e604a82cd00bf3914c5ffa691
SHA1

2dd51aeba2bea40c4dfd9c7af8a7da714f2b0570
SHA256

462c3f8b6934e5dae42edff0aa78ea8fca41d85d5b4f54a3bb82e3f8cebb7b01
SHA512

c3576663a3c419fbc33aaf4ec33c6f8478436f611f7da5775917124a6b4c1b7477b5a9006569ebd66c1a31622ddfdd77626ec68f21ce8e78799dceaaed7e843e
SSDEEP

384:6KQKU6HsXhdJgl9Y44gxxd1JcUKUSk4ohjPwQOegfABRfX6LCYi6r1Lciy2XAold:+DbJG9TxfjK1UP8eRf6uqHp84BCo

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1688	winsrv32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Server = "C:\\Windows\\winsrv32.exe"	winsrv32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\winsrv32.exe	cmd.exe
File opened for modification	C:\Windows\winsrv32.exe	cmd.exe
File opened for modification	C:\Windows\winsrv32.exe	674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 2560	436	674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe	85
PID 436 wrote to memory of 2560	436	674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe	85
PID 436 wrote to memory of 2560	436	674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe	85
PID 436 wrote to memory of 1688	436	674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe	89
PID 436 wrote to memory of 1688	436	674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe	89
PID 436 wrote to memory of 1688	436	674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\phqghu.bat
  2⤵
  - Drops file in Windows directory
  PID:2560
- C:\Windows\winsrv32.exe
  "C:\Windows\winsrv32.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\winsrv32.exe

Filesize
52KB

MD5
674e564e604a82cd00bf3914c5ffa691

SHA1
2dd51aeba2bea40c4dfd9c7af8a7da714f2b0570

SHA256
462c3f8b6934e5dae42edff0aa78ea8fca41d85d5b4f54a3bb82e3f8cebb7b01

SHA512
c3576663a3c419fbc33aaf4ec33c6f8478436f611f7da5775917124a6b4c1b7477b5a9006569ebd66c1a31622ddfdd77626ec68f21ce8e78799dceaaed7e843e

Download Submit
C:\Windows\winsrv32.exe

Filesize
52KB

MD5
b7690f9153aba846592a9c426d940af6

SHA1
cb6a0189b7410cacf5beb09c5c5298243c67b79c

SHA256
958b8422ac9fc61f45bed8a617670350f9224d8e7b543ef327e25a20e6db9cf4

SHA512
7c535663f54634609fa550df6529cdcea974487c4d411296fe25bd4a3ed79b701b7a456cd73583623efb0afbf3e8874c0f69f4b1157ab74fe3d34bc53de32df6

Download Submit
C:\phqghu.bat

Filesize
119B

MD5
caab1bad225f8607f35009917acdf6cc

SHA1
4229cd636d83d3e4f52638c283eaa1c0f36a0bcc

SHA256
19c515ad5c797af358c4319696900678072b4a0a3533ef11b66fb272f370747c

SHA512
6a40dd4b008026d6f9674b1516440e7d7b1cfa1384c18bdc8609a3336956b1e42ec5eb8d4f28baf778f6c681cacd099beb5c9b3195c056cb4dfceeab769f0827

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads