93f25c6408d8c1ba344c5cf8b206b0145c6d030c28cd23568dd03e27249c77ca

Analysis

max time kernel
133s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe
Size

10KB
MD5

756dbc6a7b99424cb63590daadb3f73a
SHA1

b5fc884b5d1bb5b38cf4bb37ade1e75db5d8f71c
SHA256

93f25c6408d8c1ba344c5cf8b206b0145c6d030c28cd23568dd03e27249c77ca
SHA512

e1b1cbdb2ed04a348e3d51f871a64b3c0b43b4217d959daa52fb58042a9eb27c178d15647f3bfeb27eb61b0623efe3d7fb7f432230e53bef9e582d5c4923ed18
SSDEEP

192:OjfO4JtTSaXqs1T6ka2MwLE1Uclsu1CVbQENQv50wqMT8UQLr0KMaap:OjxJ113vMME1Uclsu1pEgqMT8Un/aY

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\midimapcb = "{4F4F0064-71E0-4f0d-0006-708476C7815F}"	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1000	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\midimapcb.dat	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\midimapcb.tmp	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\midimapcb.tmp	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F4F0064-71E0-4f0d-0006-708476C7815F}	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F4F0064-71E0-4f0d-0006-708476C7815F}\InProcServer32	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F4F0064-71E0-4f0d-0006-708476C7815F}\InProcServer32\ = "C:\\Windows\\SysWow64\\midimapcb.dll"	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F4F0064-71E0-4f0d-0006-708476C7815F}\InProcServer32\ThreadingModel = "Apartment"	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1000	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe
1000	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1000	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 2292	1000	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe	89
PID 1000 wrote to memory of 2292	1000	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe	89
PID 1000 wrote to memory of 2292	1000	756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\756dbc6a7b99424cb63590daadb3f73a_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\E985.tmp.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E985.tmp.bat

Filesize
207B

MD5
44ee85f986851abb932ea8d95aaf70e0

SHA1
2b85fa2fb15447bf7069c72e55ca2b5c9fec46ac

SHA256
82e0ee326ff2464fe10e1eb43e1047f0fd3043541b6fddddde46add5961e94e5

SHA512
1468065c3b8a00a87188a18bd1b74feee310d6f5e297496c6cea5d73f16b6802fe308ca9bf6765a628212835560447d7ed80751762569dc16c74a15f1ae8179b

Download Submit
C:\Windows\SysWOW64\midimapcb.dll

Filesize
1.0MB

MD5
a35d3dc2352ea501c82b1c1ca19722bd

SHA1
85fd53e586be5811d5cc0eb3c554895af277a069

SHA256
9b3cc432c17ead1469ed1dcdab4679c34b9d9d9737c503bcee07955e1ab65ea5

SHA512
62ebafa07aaca8f412f13bca91eb6d8ce06247e92bd628147543c2020ef29304f5b3a404ab5b4c9ed8c294a95b201c89b84203578b868403974fab38cd5bbf69

Download Submit