6bab83c66e971dfd276cf2f0ec2ef1111d0a8b008cacf2a526a8f91249c84e83

Analysis

max time kernel
133s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe
Size

12KB
MD5

d2f58b1542808d6260bacedf5a1b0f0e
SHA1

739c70b7a31ae9888d4227218a2e1537afd275bc
SHA256

6bab83c66e971dfd276cf2f0ec2ef1111d0a8b008cacf2a526a8f91249c84e83
SHA512

2acf3b4b4e90d9156552b16083de550c6d90c7f3411d40106bf83cc9a40ceeb8511f9209981621bca1fc0b4b394aad0ccd187c56301d0a837d4baac0fb41d35c
SSDEEP

384:kqC2ek+t2vSrAXq5kRP1p8WMtZj2ixthWwB:kqCw+t2RXq5kRm2mhWwB

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\kbdgrms.dll = "{E560642D-A32D-432c-9E7E-9A135CC37E0F}"	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
116	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kbdgrms.tmp	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\kbdgrms.tmp	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E560642D-A32D-432c-9E7E-9A135CC37E0F}\InProcServer32\ThreadingModel = "Apartment"	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E560642D-A32D-432c-9E7E-9A135CC37E0F}	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E560642D-A32D-432c-9E7E-9A135CC37E0F}\InProcServer32	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E560642D-A32D-432c-9E7E-9A135CC37E0F}\InProcServer32\ = "C:\\Windows\\SysWow64\\kbdgrms.dll"	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
116	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe
116	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
116	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe
116	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe
116	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4844	116	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe	97
PID 116 wrote to memory of 4844	116	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe	97
PID 116 wrote to memory of 4844	116	d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2f58b1542808d6260bacedf5a1b0f0e_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\31AA.tmp.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\31AA.tmp.bat

Filesize
207B

MD5
7569ab92562fb90705a5de9c786badab

SHA1
c7531b69536df364e93fb4dfa1e0741b964b2294

SHA256
243c2077e9e55ec072aae17829b1f259246299462b5447d92f994a50db228b3b

SHA512
3c9e67f0d69507f21f80103368f2e8ff1b5f47cbb57bc839ea4216c32d525e18505a5d890121c0d7c9d8a515aa9359f62232b274eb970e07761c107f09136323

Download Submit
C:\Windows\SysWOW64\kbdgrms.dll

Filesize
2.5MB

MD5
26ad5e0bf57abb6ce5272e6f221fe701

SHA1
012ceffc47b83ef625b742c42a9dd95b48ff4ded

SHA256
f3da8786acbca1c41040460942c0a2e50734b935dd627f71b8d3d0f30eda25b0

SHA512
e17b1ed8be818e190fe24d9de417e5aa1e713e134a85598d942f797101af1385b02a4ccd099c6045bdd08294dee666f3725a498159d8632fd2274adc005497ca

Download Submit
memory/116-6-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/116-11-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download