5a0b146a741d3d480f17d0fb88dbc1c54ccf50249589f08d758b82e1017d1b90

Analysis

max time kernel
94s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2024, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
Size

236KB
MD5

b4ebe29f91aa6674a59d86a74bd1a6b4
SHA1

dd7284838ce5b86724d288fa20b0aec1f6af50b8
SHA256

5a0b146a741d3d480f17d0fb88dbc1c54ccf50249589f08d758b82e1017d1b90
SHA512

ba07be28a17ed88600836966d3fe984eb273327e7012b591da281e3d82674773ba1b3fc5022fa5b152c7132928b713ed4cd1acb755eb3ea4760c314a8bef6bfc
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8HpjBFy11Awg:o68i3odBiTl2+TCU/OhuhuIpRL0

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\winhash_up.exez	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File opened for modification	C:\Windows\winhash_up.exez	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File created	C:\Windows\bugMAKER.bat	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File created	C:\Windows\winhash_up.exe	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2432	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2432	1964	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe	82
PID 1964 wrote to memory of 2432	1964	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe	82
PID 1964 wrote to memory of 2432	1964	b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
90B

MD5
d7c43e84d23fad4494f9354448d874db

SHA1
9a099befa1d0152ab4a17ddd3d0b57fc0cc86c9b

SHA256
65ac077bc265b6a987cb670e08ee4a3d25857a1e7a222a13d1d90b1a28dea979

SHA512
9099a72be626943e46457dee515b28a80905e9538ad21399cb173d89af7e24af930bc3c7e004bb0fb467f7057759731d3e17a938753a960594bf55513c5877d5

Download Submit
memory/1964-24-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads