1d0047da3a3a4a406dbb7edbe35fe3e9b3d23f8b39ed5d20028769e82287d8d5

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe
Size

481KB
MD5

c1c1b259314fe09d145d3a30b6da41ac
SHA1

6ccb19311356e3d6b0c19280eceae8a619f76135
SHA256

1d0047da3a3a4a406dbb7edbe35fe3e9b3d23f8b39ed5d20028769e82287d8d5
SHA512

661e84e8c72ce63b14d8310573a3280800eb3a86b3d57301715b4d48b2e08c8d84b9f10b67593f3c286a4238f082bdfceb582405e956aa1c53da6cb6ec9d410b
SSDEEP

12288:wyv8IW1+jO02hk5R8HFueFAItnX175qUrpbjcAUOz3NhXjM1Yjk:BkIWh02hCCHvAI1BUU9PK+zM1Yjk

Score

10^/10

defense_evasion discovery evasion execution persistence upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	E4U.exe

Executes dropped EXE 7 IoCs

pid	Process
1976	ic1.exe
1392	7za.exe
3140	ic1.exe
748	EuroP.exe
2720	E4U.exe
4488	Gi.exe
4392	geurge.exe

Loads dropped DLL 1 IoCs

pid	Process
2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002345b-36.dat	upx
behavioral2/memory/4488-46-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/4488-62-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/4392-75-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ewrgetuj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\geurge.exe"	Gi.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	geurge.exe
File opened (read-only)	\??\w:	geurge.exe
File opened (read-only)	\??\x:	geurge.exe
File opened (read-only)	\??\h:	geurge.exe
File opened (read-only)	\??\i:	geurge.exe
File opened (read-only)	\??\j:	geurge.exe
File opened (read-only)	\??\p:	geurge.exe
File opened (read-only)	\??\b:	geurge.exe
File opened (read-only)	\??\g:	geurge.exe
File opened (read-only)	\??\o:	geurge.exe
File opened (read-only)	\??\q:	geurge.exe
File opened (read-only)	\??\r:	geurge.exe
File opened (read-only)	\??\y:	geurge.exe
File opened (read-only)	\??\l:	geurge.exe
File opened (read-only)	\??\m:	geurge.exe
File opened (read-only)	\??\s:	geurge.exe
File opened (read-only)	\??\t:	geurge.exe
File opened (read-only)	\??\u:	geurge.exe
File opened (read-only)	\??\a:	geurge.exe
File opened (read-only)	\??\e:	geurge.exe
File opened (read-only)	\??\k:	geurge.exe
File opened (read-only)	\??\v:	geurge.exe
File opened (read-only)	\??\z:	geurge.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4312	sc.exe
3480	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4892	748	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ic1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ic1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EuroP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E4U.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geurge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2720	E4U.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4488	Gi.exe
4488	Gi.exe
4488	Gi.exe
4488	Gi.exe
4392	geurge.exe
4392	geurge.exe
4392	geurge.exe
4392	geurge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1976	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	84
PID 2968 wrote to memory of 1976	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	84
PID 2968 wrote to memory of 1976	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	84
PID 2968 wrote to memory of 1392	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	85
PID 2968 wrote to memory of 1392	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	85
PID 2968 wrote to memory of 1392	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	85
PID 2968 wrote to memory of 3140	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	88
PID 2968 wrote to memory of 3140	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	88
PID 2968 wrote to memory of 3140	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	88
PID 2968 wrote to memory of 748	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	89
PID 2968 wrote to memory of 748	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	89
PID 2968 wrote to memory of 748	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	89
PID 2968 wrote to memory of 2720	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	90
PID 2968 wrote to memory of 2720	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	90
PID 2968 wrote to memory of 2720	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	90
PID 2968 wrote to memory of 4488	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	92
PID 2968 wrote to memory of 4488	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	92
PID 2968 wrote to memory of 4488	2968	c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe	92
PID 2720 wrote to memory of 1212	2720	E4U.exe	95
PID 2720 wrote to memory of 1212	2720	E4U.exe	95
PID 2720 wrote to memory of 1212	2720	E4U.exe	95
PID 4488 wrote to memory of 4392	4488	Gi.exe	97
PID 4488 wrote to memory of 4392	4488	Gi.exe	97
PID 4488 wrote to memory of 4392	4488	Gi.exe	97
PID 4488 wrote to memory of 4064	4488	Gi.exe	98
PID 4488 wrote to memory of 4064	4488	Gi.exe	98
PID 4488 wrote to memory of 4064	4488	Gi.exe	98
PID 4488 wrote to memory of 4312	4488	Gi.exe	99
PID 4488 wrote to memory of 4312	4488	Gi.exe	99
PID 4488 wrote to memory of 4312	4488	Gi.exe	99
PID 4488 wrote to memory of 4576	4488	Gi.exe	100
PID 4488 wrote to memory of 4576	4488	Gi.exe	100
PID 4488 wrote to memory of 4576	4488	Gi.exe	100
PID 4488 wrote to memory of 3480	4488	Gi.exe	102
PID 4488 wrote to memory of 3480	4488	Gi.exe	102
PID 4488 wrote to memory of 3480	4488	Gi.exe	102
PID 4488 wrote to memory of 3288	4488	Gi.exe	104
PID 4488 wrote to memory of 3288	4488	Gi.exe	104
PID 4488 wrote to memory of 3288	4488	Gi.exe	104
PID 4064 wrote to memory of 4612	4064	net.exe	108
PID 4064 wrote to memory of 4612	4064	net.exe	108
PID 4064 wrote to memory of 4612	4064	net.exe	108
PID 4576 wrote to memory of 4912	4576	net.exe	109
PID 4576 wrote to memory of 4912	4576	net.exe	109
PID 4576 wrote to memory of 4912	4576	net.exe	109

C:\Users\Admin\AppData\Local\Temp\c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c1c1b259314fe09d145d3a30b6da41ac_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\ic1.exe
  "C:\Users\Admin\AppData\Local\Temp\ic1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\7za.exe
  C:\Users\Admin\AppData\Local\Temp\7za.exe x C:\Users\Admin\AppData\Local\Temp\a1.7z -aoa -oC:\Users\Admin\AppData\Local\Temp -plolmilf
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1392
- C:\Users\Admin\AppData\Local\Temp\ic1.exe
  "C:\Users\Admin\AppData\Local\Temp\ic1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3140
- C:\Users\Admin\AppData\Local\Temp\EuroP.exe
  "C:\Users\Admin\AppData\Local\Temp\EuroP.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 384
    3⤵
    - Program crash
    PID:4892
- C:\Users\Admin\AppData\Local\Temp\E4U.exe
  "C:\Users\Admin\AppData\Local\Temp\E4U.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E4U.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1212
- C:\Users\Admin\AppData\Local\Temp\Gi.exe
  "C:\Users\Admin\AppData\Local\Temp\Gi.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Users\Admin\AppData\Local\Temp\geurge.exe
    C:\Users\Admin\AppData\Local\Temp\geurge.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4392
- - C:\Windows\SysWOW64\net.exe
    net.exe stop "Security Center"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Security Center"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc config wscsvc start= DISABLED
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4312
- - C:\Windows\SysWOW64\net.exe
    net.exe stop "Windows Firewall/Internet Connection Sharing (ICS)
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= DISABLED
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\tujserrew.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 748 -ip 748
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7za.exe

Filesize
523KB

MD5
e92604e043f51c604b6d1ac3bcd3a202

SHA1
4154dda4a1e2a5ed14303dc3d36f448953ff6d33

SHA256
fa252e501332b7486a972e7e471cf6915daa681af35c6aa102213921093eb2a3

SHA512
ef396d94d83fd7a588c6e645ea5fcfe24390440a03b3bf0ecd05ca6749fd3f9561dfafe725ee0edea51a34d52af26cd311e768aa72f75686cc796abee4757d43

Download Submit
C:\Users\Admin\AppData\Local\Temp\E4U.exe

Filesize
17KB

MD5
45bc75f2eecdf40db982792d469c36c3

SHA1
ae0747ea02043f6658522564fb3bf8bb3a15073c

SHA256
b0a5646a7e940a1605bb86bd0ab77a3c2d15391c28220bc4492e895282250ac4

SHA512
fe47c23767c4f3a538cf43457ef6ddf45845f053dfaf819d5491c769b4fa56fade2202e9d999937024374fc9ff727f3a64f2da5ae3dedc995469d1bed5c15d36

Download Submit
C:\Users\Admin\AppData\Local\Temp\EuroP.exe

Filesize
110KB

MD5
e8d0d25c04f271edc90a94150f87f59d

SHA1
62039eea3ba98d66b27baf9a37d7b864b3f70794

SHA256
c8b5dc1734e3b3ada478279106b94e00c3712e524bf2a79a917c0396b16d42c9

SHA512
d20afafe233db2c5f519281203dc991f64c966b000bc1df33b58aea105859405e4264ed250a4939460e4298beb8a4eef783fc3af91b37938e5c3e8307e755916

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gi.exe

Filesize
74KB

MD5
1e6ffc15dc65355b1172c55d30a997d8

SHA1
34577258e7d5d2bb8985c245df8751f69f035392

SHA256
af5458789cdec711b5e503851ddd5421685e7bc536f08a6d93ce7c4a97fbfb62

SHA512
516583453214e4dfc8caa117cdae9a70debfe66b9f31ded644b61d126a823fb4f1e24766dfa22d02995ace51fc454f55e77f287cef6d6bf0cf4715c2da2d7e03

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1.7z

Filesize
210KB

MD5
87c25152ee2ecf48ec553a60277036e2

SHA1
4250154e95073477efcd739d2e5824bae17f8b80

SHA256
c692526ce39ef42e58837a24d6ea75fc0a37d01f857e05b647d736d416f3619e

SHA512
09504b34fa072dd6aa3b41664df36d6f5f16d614fdf8583115be21acaaf45b34d4b672d32adbf561c2c7d6551e10faf3a1834c354c1307fdf6e59f4461acb2f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ic1.exe

Filesize
3KB

MD5
46e07fd3a40760fda18cf6b4fc691742

SHA1
53ee1a754bf5e94fa88a6ab8bb6120b4011afcfa

SHA256
bd7ca609d2fb63e14d08acab1091579c23e298b4fa2ac1e8d2daaff94fc107be

SHA512
ce13f6527cbd13002dca00b71ab38ab12e3f3f7138ada0780ad3f40e7c49946c018a00782ec957b1fd123fb439aabc0d9b3660829dabf10ddcebba08d6e2fbbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ic1.exe

Filesize
78KB

MD5
9a708fe904309073cec997a3f685c221

SHA1
ca4773b2ef84aca3bf6abe848b2ff3b3d1509a28

SHA256
274f51b3c8a5f2eec0b4a4e97a79b7fe8de52e0b83ecdd693e5473ca5beb3361

SHA512
cd33d51ce6c1bc49acff0c46136f7510f9d1ffd000d8b1fc4d6fe9d8a97a4d922162c2c22005a5a6ac90263e5b154854f078c66619a91ca7c5757ba575bd21e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse9D8A.tmp\ExecDos.dll

Filesize
5KB

MD5
a7cd6206240484c8436c66afb12bdfbf

SHA1
0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919

SHA256
69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926

SHA512
b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904

Download Submit
C:\tujserrew.bat

Filesize
130B

MD5
d08cb97e3b90ca2dac463f834008b9b9

SHA1
3db0d4da98d144669284f50d9e8ea87a988ac93a

SHA256
033632928b0c1a737728bb51db824f5fc92c84cbebae99553e8a1f40bd05b8f9

SHA512
d843a43695c808bf3ee6088e5213f5b97f225412c36a41778a41a950c7459e4e9c4332b98bc9007544863e4d39b5f11bf15308ceeaceff7320847d301febe97d

Download Submit
memory/748-35-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2720-38-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2720-43-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3140-50-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3140-39-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3140-74-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4392-75-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4488-46-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4488-62-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads