6180a981f9ea6c7d723adf87d04fe21dffc9b5f5759603ea0f20764164d640f5

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
Size

149KB
MD5

a4abc368c1520f23dce1bfcac6496fac
SHA1

549253ad371634e655c3be6215e8da0f50d66207
SHA256

6180a981f9ea6c7d723adf87d04fe21dffc9b5f5759603ea0f20764164d640f5
SHA512

da02cbaea5fa23760fd765a2ae2520ec2831cc8e465132941b82189f3a92dba739882c78be88bb9ffb6b466bbccb09ef44129e78336814217fdf5de9ab251f04
SSDEEP

3072:QwkZLpqNDYm06rBSyvBhPI8c1xic81e5HUs9bBAXIrm:Qw8Lprm069SyvBGZajM5Hx9W4rm

Score

8^/10

discovery persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\hebe = "C:\\Windows\\system32\\com\\wellsnow.exe"	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\com\wellsnow.exe	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\com\wellsnow.exe	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wellsnow.dll	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3380	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
3380	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
3380	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
3380	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 3380	3704	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe	84
PID 3704 wrote to memory of 3380	3704	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe	84
PID 3704 wrote to memory of 3380	3704	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe	84
PID 3380 wrote to memory of 3472	3380	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe	56

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer	a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3472
- C:\Users\Admin\AppData\Local\Temp\a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Users\Admin\AppData\Local\Temp\a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a4abc368c1520f23dce1bfcac6496fac_JaffaCakes118.exe"
    3⤵
    - Adds policy Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~temp0585502938.tmp

Filesize
12B

MD5
c02fbbc5203fe903ffabc28101e5b61f

SHA1
f18f0ff09bb6bf55215bed6c14cf3c17c8767be2

SHA256
a38fab2c4ec92fc4a6a0d6a2fb936663ce5644a5b462000a59f6229e2b99a6d0

SHA512
12e0fcaa53476c088fa111664290b20492896e268ce7c5eaafddaa9a0e3a0a7555cfae27352fed2b2e283e1cb4b2205c3fccd064513e8a0cd58a830d9b77697c

Download Submit
memory/3380-6-0x0000000000490000-0x0000000000590000-memory.dmp

Filesize
1024KB

Download
memory/3380-10-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/3704-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3704-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download