d4d29b09a20f3899ad3ec2fe81e825b42ba6839bfe55502fd0624ef8e816d06b

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7d7225f07f69835b236240527461666_JaffaCakes118.exe
Size

14KB
MD5

a7d7225f07f69835b236240527461666
SHA1

12876011f9e8ce346b70d5dc8d85728ea72be54d
SHA256

d4d29b09a20f3899ad3ec2fe81e825b42ba6839bfe55502fd0624ef8e816d06b
SHA512

fd11f3f9ace7912540c3bd0083b531d21f7bb77446a6e5c1f7449a11934756678de2db6567dcd0ece47840d81ad0ac0c2abc1ab95be289ef866cfb91fc25a331
SSDEEP

384:mNW/W5FGOu7H8/D9X9wj6gHxPO/uS8i9Puej0rV:oWHqD9V2xPK89ej0rV

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\D6F57DE7\ImagePath = "C:\\Windows\\system32\\993FBFB6.EXE -k"	a7d7225f07f69835b236240527461666_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1628	993FBFB6.EXE

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\993FBFB6.EXE	993FBFB6.EXE
File created	C:\Windows\SysWOW64\993FBFB6.DLL	993FBFB6.EXE
File created	C:\Windows\SysWOW64\delme.bat	a7d7225f07f69835b236240527461666_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\993FBFB6.EXE	a7d7225f07f69835b236240527461666_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\993FBFB6.EXE	a7d7225f07f69835b236240527461666_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7d7225f07f69835b236240527461666_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	993FBFB6.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5068	a7d7225f07f69835b236240527461666_JaffaCakes118.exe
5068	a7d7225f07f69835b236240527461666_JaffaCakes118.exe
1628	993FBFB6.EXE
1628	993FBFB6.EXE
1628	993FBFB6.EXE
1628	993FBFB6.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 868	5068	a7d7225f07f69835b236240527461666_JaffaCakes118.exe	89
PID 5068 wrote to memory of 868	5068	a7d7225f07f69835b236240527461666_JaffaCakes118.exe	89
PID 5068 wrote to memory of 868	5068	a7d7225f07f69835b236240527461666_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\a7d7225f07f69835b236240527461666_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7d7225f07f69835b236240527461666_JaffaCakes118.exe"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\delme.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:868

C:\Windows\SysWOW64\993FBFB6.EXE
C:\Windows\SysWOW64\993FBFB6.EXE -k
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\993FBFB6.EXE

Filesize
14KB

MD5
a7d7225f07f69835b236240527461666

SHA1
12876011f9e8ce346b70d5dc8d85728ea72be54d

SHA256
d4d29b09a20f3899ad3ec2fe81e825b42ba6839bfe55502fd0624ef8e816d06b

SHA512
fd11f3f9ace7912540c3bd0083b531d21f7bb77446a6e5c1f7449a11934756678de2db6567dcd0ece47840d81ad0ac0c2abc1ab95be289ef866cfb91fc25a331

Download Submit
C:\Windows\SysWOW64\delme.bat

Filesize
239B

MD5
5ae0aaef4c809474958f9d1c46e2372f

SHA1
e9f065ef7fb2c4149b8ada31ddb3efde4942c23c

SHA256
973cb721d4f7cbc8a30c87b8de099476fa6050f5c709273c1c9ecc99b0f6a385

SHA512
d554b7c27c760f891ad1f4ad1322488829838cafe76bb1e98c4b0381c9af8a8c70147d0e6a874a9f8bb9010b580f017eca106ed40b05e8092fc0ab124ce66d71

Download Submit
memory/1628-5-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/1628-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5068-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5068-1-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/5068-9-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download