f3603cf72623943a82d830d3e63f9edf0392e062e25a1f65bbcece0739452bcf

Analysis

max time kernel
144s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3300bd250c3f457c47304d494a7740b_JaffaCakes118.exe
Size 429KB
Sample240817-tev74atfpe
SHA256 f3603cf72623943a82d830d3e63f9edf0392e062e25a1f65bbcece0739452bcf
MD5 a3300bd250c3f457c47304d494a7740b
SHA1 cd4d72ac32eceda4815f730f71fdb418e7fd561e
SHA512 6e4d20084ea206a89fdea1493f2b4cfa7271ee7220f2d70ba0dd86775d332e51c3878d2c10c4be4c3b95f94029a47fff66eb72a0a02f40398d58188bb1e040b8
SSDEEP 6144:aKELo7qp0yN90QE64Utj67SIQE5aHyD74veL4mKF4XXx46PWtYjUW5b:mLofy908OeIQqaHywvfmK8XjPWtuUg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	shoot1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	shoot1.exe

Executes dropped EXE 4 IoCs

pid	Process
4016	shoot1.exe
3480	CryptedFile.exe
3952	shoot1.exe
3640	CryptedFile.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a3300bd250c3f457c47304d494a7740b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3300bd250c3f457c47304d494a7740b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptedFile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptedFile.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3480	CryptedFile.exe
3480	CryptedFile.exe
3480	CryptedFile.exe
3480	CryptedFile.exe
3640	CryptedFile.exe
3640	CryptedFile.exe
3640	CryptedFile.exe
3640	CryptedFile.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 4016	3428	a3300bd250c3f457c47304d494a7740b_JaffaCakes118.exe	84
PID 3428 wrote to memory of 4016	3428	a3300bd250c3f457c47304d494a7740b_JaffaCakes118.exe	84
PID 4016 wrote to memory of 3480	4016	shoot1.exe	88
PID 4016 wrote to memory of 3480	4016	shoot1.exe	88
PID 4016 wrote to memory of 3480	4016	shoot1.exe	88
PID 3428 wrote to memory of 3952	3428	a3300bd250c3f457c47304d494a7740b_JaffaCakes118.exe	89
PID 3428 wrote to memory of 3952	3428	a3300bd250c3f457c47304d494a7740b_JaffaCakes118.exe	89
PID 3952 wrote to memory of 3640	3952	shoot1.exe	90
PID 3952 wrote to memory of 3640	3952	shoot1.exe	90
PID 3952 wrote to memory of 3640	3952	shoot1.exe	90
PID 3480 wrote to memory of 3432	3480	CryptedFile.exe	56
PID 3480 wrote to memory of 3432	3480	CryptedFile.exe	56
PID 3480 wrote to memory of 3432	3480	CryptedFile.exe	56
PID 3480 wrote to memory of 3432	3480	CryptedFile.exe	56
PID 3640 wrote to memory of 3432	3640	CryptedFile.exe	56
PID 3640 wrote to memory of 3432	3640	CryptedFile.exe	56
PID 3640 wrote to memory of 3432	3640	CryptedFile.exe	56
PID 3640 wrote to memory of 3432	3640	CryptedFile.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Users\Admin\AppData\Local\Temp\a3300bd250c3f457c47304d494a7740b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a3300bd250c3f457c47304d494a7740b_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\shoot1.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\shoot1.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe
      "C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3480
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\shoot1.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\shoot1.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe
      "C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shoot1.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\shoot1.exe.log
Size 594B
SHA256 d29f0e5fe1ab31998f200d4441c0e201a2e3bd6e416f638cbee2eb55354d48cc
MD5 44e889763d548d09132c31ed548f63f5
SHA1 d9829a1b5841338533a0be0509df50172cce73be
SHA512 a1474aaef1132f459e8139157a618368c7623f4a25a754c6fc2672d92929b9506bfcc272eebf5c69901f4140d36e740f5f6bbfb90e000c6538ab492f5aa48a96
MD5 SHA1 SHA512

Submit Download

CryptedFile.exe

Path C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe
Size 200KB
SHA256 23212f49629822a4e4a899d2ca17d4c04f25265316fa48748cf25fbe47685e31
MD5 bda4386a939dc9ae1029ea71f28a4710
SHA1 c6edd243d797d3b60884c81de26c257ca66b9540
SHA512 216ef48f6b1659e8bc08006f71d97ac4e71dfb441de641509eb432bd2ae6cbf5a4d3ef9cf12baaf842f31cfb737b4b44fedb2e6321a9921ad795e4c7af850330
SSDEEP 6144:ZAeIifU8j6MBqiKNB9oycLhEZ83NucKaY:ZRFj6vB9UhEZ83NuHaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

shoot1.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\shoot1.exe
Size 388KB
SHA256 3ee4777d9936206a53d7d9272ce46fd9b393d0e622ecbeb3723f6dde0700d15d
MD5 c6f433f5f1ba243b7d453ad5052abdff
SHA1 e346aa8e03c068073f7f4951a908a872ff09d1d0
SHA512 3fb2dc1ba627bfac17569ea5eaea6a20d7bbeb02fae6ea85d3778b4f3af8cebb09b71b8285248a2673219caf1e6db7806b4449ab6531633b391c761ec5ae1cb4
SSDEEP 6144:rCItPMo3/fv10sZMcSJrUWDPxalSXo97CPWtwjUW52w:tUo3/3zSdUWbxBoEPWtmUNw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3432-31-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Download

memory/3432-30-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Download

memory/3480-34-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3480-24-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3640-39-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3640-29-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4016-9-0x000000001C2A0000-0x000000001C33C000-memory.dmp

Download

memory/4016-14-0x00007FF99E0B0000-0x00007FF99EA51000-memory.dmp

Download

memory/4016-13-0x000000001C520000-0x000000001C56C000-memory.dmp

Download

memory/4016-11-0x0000000000F20000-0x0000000000F28000-memory.dmp

Download

memory/4016-25-0x00007FF99E0B0000-0x00007FF99EA51000-memory.dmp

Download

memory/4016-12-0x00007FF99E0B0000-0x00007FF99EA51000-memory.dmp

Download

memory/4016-10-0x00007FF99E0B0000-0x00007FF99EA51000-memory.dmp

Download

memory/4016-8-0x000000001BD30000-0x000000001C1FE000-memory.dmp

Download

memory/4016-7-0x00007FF99E0B0000-0x00007FF99EA51000-memory.dmp

Download

memory/4016-6-0x000000001B7B0000-0x000000001B856000-memory.dmp

Download

memory/4016-5-0x00007FF99E365000-0x00007FF99E366000-memory.dmp

Download