02d38b7136a18a0a039f53c6609d87e74723a1db45df36d82a5e286c6aeb783c

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe
Size

9KB
MD5

ed70265323c804b4e3872a3711ab88c9
SHA1

a046c92fc4e77645c3c6fe820e50f65538c9db7a
SHA256

02d38b7136a18a0a039f53c6609d87e74723a1db45df36d82a5e286c6aeb783c
SHA512

604e643ba38e9000161e64f18d32e3c2b36de8675bca182970b9299a311a4eaee109c57bda5deafdb1709f482b8195ac460101741ec564168625edaa4348160c
SSDEEP

192:jCOEJV4c7TWpe1omZWyO5wkGYCClBiVyfkDu+Lemlck+aM:+OEL4MNZGwXYCClUVylfzR

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\midimapfs2 = "{4F4F0064-71E0-4f0d-0025-708476C7815F}"	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
4060	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\midimapfs2.tmp	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\midimapfs2.tmp	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\midimapfs2.dat	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F4F0064-71E0-4f0d-0025-708476C7815F}	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F4F0064-71E0-4f0d-0025-708476C7815F}\InProcServer32	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F4F0064-71E0-4f0d-0025-708476C7815F}\InProcServer32\ = "C:\\Windows\\SysWow64\\midimapfs2.dll"	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F4F0064-71E0-4f0d-0025-708476C7815F}\InProcServer32\ThreadingModel = "Apartment"	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4060	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe
4060	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4060	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 5084	4060	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe	81
PID 4060 wrote to memory of 5084	4060	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe	81
PID 4060 wrote to memory of 5084	4060	ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed70265323c804b4e3872a3711ab88c9_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\5B2C.tmp.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5B2C.tmp.bat

Filesize
207B

MD5
b44514e3c265265237ed97725515dbb9

SHA1
3c3f541c7b808cd1c11bae5aee8c6a6f53315c6c

SHA256
f8245849f645acc87b4bf5e11ba4c086d439d1bdb0a4162546a35fcfdd92cdb7

SHA512
270fe441bf4bd0fc885097045cccdccb1af1e8a596407bf2619800d8d188ca6efca58bb2e218a4082e0d6e2a7f6b8fa8766360ef4022da675ed13bc3dd2d5cd3

Download Submit
C:\Windows\SysWOW64\midimapfs2.tmp

Filesize
1.0MB

MD5
64cf03ed988417efc05f3fe3c4b373c5

SHA1
4b6ed8714252853c2f6e9c289e0925964957118d

SHA256
533630010970da2c17353f34508ac1140c146cf51bf1f5d2bf5d34fb86929b9c

SHA512
fdf1f30254f50116bb178932e235c014d56e0609f461450ac081c86512bf928957f649f2d6a00899dbeeb109fb45522067bda7ee9e319f0c4492c64ea00fd26a

Download Submit