2bafea62379670c8bd6532b28ec5b9b37f61e5977d852f593d215648a3d3ab5d

Analysis

max time kernel
91s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee9d8d8f22f855560fcd0265295184bd_JaffaCakes118.exe
Size

2.0MB
MD5

ee9d8d8f22f855560fcd0265295184bd
SHA1

78a971213af8c54425be74ca6ed3ebb8aa2d7507
SHA256

2bafea62379670c8bd6532b28ec5b9b37f61e5977d852f593d215648a3d3ab5d
SHA512

0d01a1f583f436d17574fad0e6fea6ddc4554665bcdead2eff605937166b00c686346f45a5bc8136dbe80c16d704b550331a239f5a1e71c58763a53aa73d3da4
SSDEEP

49152:rGcGkHMGdPCuGjU6HMCR1Evp57SxrcMMFNZ0Bq6UufNoF7A:rGK1dyU6H1R2hx+rkFPCqAVoBA

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	ee9d8d8f22f855560fcd0265295184bd_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	1049iq36070qi99.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	x4237ws97856r61.exe

Executes dropped EXE 3 IoCs

pid	Process
4940	1049iq36070qi99.exe
3708	x4237ws97856r61.exe
4852	Protector-wnlb.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee9d8d8f22f855560fcd0265295184bd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1049iq36070qi99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x4237ws97856r61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Protector-wnlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\Version\ = "1.0"	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\ProgID	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\FLAGS	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\0\win32\ = "%systemroot%\\SysWow64\\wksprt.exe"	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\HELPDIR\	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\Implemented Categories\	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\InprocServer32	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\FLAGS\	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\HELPDIR	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\0	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\0\win32\	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\ = "WorkspaceRuntime 1.0 Type Library"	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\FLAGS\ = "0"	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\TypeLib\ = "{090204CB-F5D4-85F5-6456-2D17CF62A2BF}"	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\Version\	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\InprocServer32\	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\ProgID\ = "WSHController"	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\InprocServer32\ = "C:\\Windows\\SysWOW64\\wshcon.dll"	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\Version	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\0\win32	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\HELPDIR\ = "%systemroot%\\system32"	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\TypeLib\	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{090204CB-F5D4-85F5-6456-2D17CF62A2BF}\1.0\0\	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\TypeLib	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\ = "Wixibjonma Beper Eqobrat class"	x4237ws97856r61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\Implemented Categories	x4237ws97856r61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AB971AB-4274-4DFF-9188-626A452F6708}\ProgID\	x4237ws97856r61.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	x4237ws97856r61.exe
Token: SeShutdownPrivilege	3708	x4237ws97856r61.exe
Token: SeDebugPrivilege	4852	Protector-wnlb.exe
Token: SeShutdownPrivilege	4852	Protector-wnlb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3708	x4237ws97856r61.exe
4852	Protector-wnlb.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4940	3572	ee9d8d8f22f855560fcd0265295184bd_JaffaCakes118.exe	84
PID 3572 wrote to memory of 4940	3572	ee9d8d8f22f855560fcd0265295184bd_JaffaCakes118.exe	84
PID 3572 wrote to memory of 4940	3572	ee9d8d8f22f855560fcd0265295184bd_JaffaCakes118.exe	84
PID 4940 wrote to memory of 3708	4940	1049iq36070qi99.exe	85
PID 4940 wrote to memory of 3708	4940	1049iq36070qi99.exe	85
PID 4940 wrote to memory of 3708	4940	1049iq36070qi99.exe	85
PID 3708 wrote to memory of 4852	3708	x4237ws97856r61.exe	86
PID 3708 wrote to memory of 4852	3708	x4237ws97856r61.exe	86
PID 3708 wrote to memory of 4852	3708	x4237ws97856r61.exe	86
PID 3708 wrote to memory of 2448	3708	x4237ws97856r61.exe	87
PID 3708 wrote to memory of 2448	3708	x4237ws97856r61.exe	87
PID 3708 wrote to memory of 2448	3708	x4237ws97856r61.exe	87

C:\Users\Admin\AppData\Local\Temp\ee9d8d8f22f855560fcd0265295184bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee9d8d8f22f855560fcd0265295184bd_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\1049iq36070qi99.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\1049iq36070qi99.exe" -e -p7h4guvtvuazpj9m
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\x4237ws97856r61.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\x4237ws97856r61.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Users\Admin\AppData\Roaming\Protector-wnlb.exe
      C:\Users\Admin\AppData\Roaming\Protector-wnlb.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\X4237W~1.EXE" >> NUL
      4⤵
      System Location Discovery: System Language Discovery
      PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1049iq36070qi99.exe

Filesize
1.9MB

MD5
fac3d3f30e2d2ad274c26c6dc0d83532

SHA1
822648c93c689e7693a02a26df364a0df993f6cd

SHA256
f22aa504813d9e570115d5083c83981d57f86ab7a06aff4bbdf32c815d460ee2

SHA512
0d99e1411586a152ae3a8840d3d4d55431f73451f794e2b08cb4881b544470cf47f2c8f4e6cf167b58e2c93e5c818fe123e01870fb31d4aedf2ff53c7709ab92

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\x4237ws97856r61.exe

Filesize
1.8MB

MD5
870ff8903d2b6bc3a5835fb084cb540c

SHA1
e32669637335bb278a48794a779f9be6b35073ac

SHA256
6035cb6edc4a41b6445d85196b340c30b2ae0ea3ad7342e96fe936805bc48095

SHA512
ef5f5e0ad248360788428b68b55f9da1e7675b5e73ab48fb722cc79612eacc3b4e38397c102e559cd1baf08052a83ed04778534cbf8f3fc6b1a1d632f1b61789

Download Submit
memory/3708-21-0x0000000000400000-0x00000000007D0000-memory.dmp

Filesize
3.8MB

Download
memory/3708-30-0x0000000000400000-0x00000000007D0000-memory.dmp

Filesize
3.8MB

Download
memory/4852-26-0x0000000000400000-0x00000000007D0000-memory.dmp

Filesize
3.8MB

Download
memory/4852-29-0x0000000000400000-0x00000000007D0000-memory.dmp

Filesize
3.8MB

Download