622d580dc26dc81d0d9a4c0a396db513737e7237d166e2b6c1d9a66fa71821e9

Analysis

max time kernel
141s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe
Size

2.0MB
MD5

93af744fa95d6ead692424cbbab3e8e5
SHA1

286b3ddd319bd8d5e49db6675ff6dada73d86930
SHA256

622d580dc26dc81d0d9a4c0a396db513737e7237d166e2b6c1d9a66fa71821e9
SHA512

d4097194ffe68f31412756551c0f154f15ad6fdaa3e485a6b4815eb64f546bc0884541129f64ed5cb46e6bdefb724749c065f3bb7622799611adf111d9ebfdfc
SSDEEP

49152:r8cUfZsF6GWhsesortO2FAZ8mlQuR7Djfan3zIEUttrx7H2:r8XxxGWhDjWDQ+QoDx2

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	5ke5w833eo7e9wm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	6eqxwk49u166oll.exe

Executes dropped EXE 3 IoCs

pid	Process
2668	5ke5w833eo7e9wm.exe
1844	6eqxwk49u166oll.exe
5116	Protector-bgaf.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ke5w833eo7e9wm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6eqxwk49u166oll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Protector-bgaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\InprocServer32	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\ProgID	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\VersionIndependentProgID\ = "MDACVer.Version"	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\ProgID\ = "MDACVer.Version.6.0"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\Programmable	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\Programmable\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\0\win64\ = "C:\\Windows\\SysWow64\\PortableDeviceConnectApi.dll"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\VersionIndependentProgID	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\ = "PortableDeviceConnectAPI 1.0 Type Library"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\0	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\0\win32	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\0\win32\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\ = "Onagil Class"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\InstalledVersion	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\0\	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\TypeLib	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\TypeLib\ = "{490962A7-9BC5-58D8-036F-B086896D24AF}"	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\InstalledVersion\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\ProgID\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\FLAGS\ = "0"	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\0\win64\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\Version\ = "2.32"	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\InprocServer32\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\InprocServer32\ = "C:\\Windows\\SysWOW64\\odbcconf.dll"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\0\win64	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\PortableDeviceConnectApi.dll"	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\FLAGS	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\TypeLib\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\FLAGS\	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\Version	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\Version\	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\VersionIndependentProgID\	6eqxwk49u166oll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C21C3DDB-DBC9-4891-3BA0-3517050F44BD}\InstalledVersion\ = "2,80,1022,0"	6eqxwk49u166oll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{490962A7-9BC5-58D8-036F-B086896D24AF}\1.0\	6eqxwk49u166oll.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	6eqxwk49u166oll.exe
Token: SeShutdownPrivilege	1844	6eqxwk49u166oll.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1844	6eqxwk49u166oll.exe
5116	Protector-bgaf.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 2668	3644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe	87
PID 3644 wrote to memory of 2668	3644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe	87
PID 3644 wrote to memory of 2668	3644	93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe	87
PID 2668 wrote to memory of 1844	2668	5ke5w833eo7e9wm.exe	88
PID 2668 wrote to memory of 1844	2668	5ke5w833eo7e9wm.exe	88
PID 2668 wrote to memory of 1844	2668	5ke5w833eo7e9wm.exe	88
PID 1844 wrote to memory of 5116	1844	6eqxwk49u166oll.exe	89
PID 1844 wrote to memory of 5116	1844	6eqxwk49u166oll.exe	89
PID 1844 wrote to memory of 5116	1844	6eqxwk49u166oll.exe	89
PID 1844 wrote to memory of 4264	1844	6eqxwk49u166oll.exe	90
PID 1844 wrote to memory of 4264	1844	6eqxwk49u166oll.exe	90
PID 1844 wrote to memory of 4264	1844	6eqxwk49u166oll.exe	90

C:\Users\Admin\AppData\Local\Temp\93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\5ke5w833eo7e9wm.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\5ke5w833eo7e9wm.exe" -e -pe17js56fq1jh4vq
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\6eqxwk49u166oll.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\6eqxwk49u166oll.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Users\Admin\AppData\Roaming\Protector-bgaf.exe
      C:\Users\Admin\AppData\Roaming\Protector-bgaf.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5116
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\6EQXWK~1.EXE" >> NUL
      4⤵
      System Location Discovery: System Language Discovery
      PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\5ke5w833eo7e9wm.exe

Filesize
1.9MB

MD5
8666dfab99a3fce2ea7a918b066e65aa

SHA1
543bc086ecd3385f1fc318d9b0ee0e25826b9461

SHA256
5a006ca284cfcc4943936eed87e8a3bf4c7c88f62ca0fa0886f668ab334dbfa5

SHA512
a3b286394b2c752e67a7f68b56c3e9d00fccba2c97940a9c3dafd480a30f2129cf6936ed18ef51ca692aa025481fff94e46f983bc2351023f0b1b1495604fa8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\6eqxwk49u166oll.exe

Filesize
1.8MB

MD5
136ab618780fb3403e2dcc821304df9f

SHA1
02d6c8f4666ec537e5b3a18e9b6524b352aff7c2

SHA256
854970158c1514690772a753fdaed4662ece99019f83c2cb6139765b8b02fd7e

SHA512
889825d9ec2906b067f20a8194863e3f88ebaf7a65462b0deecee52fba4ae786677403e3cf4d685775437960114a449ed9d57a180b0e96cdbfe25b0466c9eeb8

Download Submit
memory/1844-21-0x0000000000400000-0x00000000007D9000-memory.dmp

Filesize
3.8MB

Download
memory/1844-27-0x0000000000400000-0x00000000007D9000-memory.dmp

Filesize
3.8MB

Download
memory/5116-29-0x0000000000400000-0x00000000007D9000-memory.dmp

Filesize
3.8MB

Download
memory/5116-26-0x0000000000400000-0x00000000007D9000-memory.dmp

Filesize
3.8MB

Download