Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 11:27
Static task
static1
Behavioral task
behavioral1
Sample
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe
-
Size
368KB
-
MD5
345c37943c7a7e1fd0098aab07fe3c86
-
SHA1
ff8d484c90feab90b94502fbcaff84b16eb9a280
-
SHA256
1e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa
-
SHA512
888e8d2f20ccf440107971e8268d06b34aa8c7e5c476f55544321780f30af52c731ada5cca83f015b607f3b61dc5be276199a9dd3cc50fd70ed47c38ca5495cd
-
SSDEEP
6144:GpWnsT313ntnJiuPn28TTc48OSswYLi9zdsPqw73hJfrhIN:+3Xnguf2ic/swVzWBJT4
Malware Config
Extracted
buer
https://162.244.81.87/
http://162.244.81.87:8080/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
gennt.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\07ba8bb00089d54f9f49\\gennt.exe\"" gennt.exe -
Processes:
resource yara_rule behavioral2/memory/4900-0-0x00000000023D0000-0x00000000023DC000-memory.dmp buer behavioral2/memory/4900-4-0x00000000023C0000-0x00000000023CA000-memory.dmp buer behavioral2/memory/3648-17-0x00000000020D0000-0x00000000020DC000-memory.dmp buer -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
gennt.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation gennt.exe -
Deletes itself 1 IoCs
Processes:
gennt.exepid process 3648 gennt.exe -
Executes dropped EXE 1 IoCs
Processes:
gennt.exepid process 3648 gennt.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
gennt.exedescription ioc process File opened (read-only) \??\Z: gennt.exe File opened (read-only) \??\L: gennt.exe File opened (read-only) \??\P: gennt.exe File opened (read-only) \??\X: gennt.exe File opened (read-only) \??\N: gennt.exe File opened (read-only) \??\T: gennt.exe File opened (read-only) \??\V: gennt.exe File opened (read-only) \??\B: gennt.exe File opened (read-only) \??\E: gennt.exe File opened (read-only) \??\M: gennt.exe File opened (read-only) \??\Q: gennt.exe File opened (read-only) \??\R: gennt.exe File opened (read-only) \??\S: gennt.exe File opened (read-only) \??\U: gennt.exe File opened (read-only) \??\Y: gennt.exe File opened (read-only) \??\I: gennt.exe File opened (read-only) \??\J: gennt.exe File opened (read-only) \??\O: gennt.exe File opened (read-only) \??\K: gennt.exe File opened (read-only) \??\W: gennt.exe File opened (read-only) \??\A: gennt.exe File opened (read-only) \??\G: gennt.exe File opened (read-only) \??\H: gennt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 828 3476 WerFault.exe secinit.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
gennt.exepid process 3648 gennt.exe 3648 gennt.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exegennt.exepid process 4900 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe 4900 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe 3648 gennt.exe 3648 gennt.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exegennt.exedescription pid process target process PID 4900 wrote to memory of 3648 4900 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe gennt.exe PID 4900 wrote to memory of 3648 4900 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe gennt.exe PID 4900 wrote to memory of 3648 4900 345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe gennt.exe PID 3648 wrote to memory of 3476 3648 gennt.exe secinit.exe PID 3648 wrote to memory of 3476 3648 gennt.exe secinit.exe PID 3648 wrote to memory of 3476 3648 gennt.exe secinit.exe PID 3648 wrote to memory of 3476 3648 gennt.exe secinit.exe PID 3648 wrote to memory of 3476 3648 gennt.exe secinit.exe PID 3648 wrote to memory of 3476 3648 gennt.exe secinit.exe PID 3648 wrote to memory of 3476 3648 gennt.exe secinit.exe PID 3648 wrote to memory of 3476 3648 gennt.exe secinit.exe PID 3648 wrote to memory of 3476 3648 gennt.exe secinit.exe PID 3648 wrote to memory of 3476 3648 gennt.exe secinit.exe PID 3648 wrote to memory of 4636 3648 gennt.exe cmd.exe PID 3648 wrote to memory of 4636 3648 gennt.exe cmd.exe PID 3648 wrote to memory of 4636 3648 gennt.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\07ba8bb00089d54f9f49\gennt.exeC:\ProgramData\07ba8bb00089d54f9f49\gennt.exe "C:\Users\Admin\AppData\Local\Temp\345c37943c7a7e1fd0098aab07fe3c86_JaffaCakes118.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\07ba8bb00089d54f9f49\gennt.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 4804⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\07ba8bb00089d54f9f49}"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3476 -ip 34761⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\07ba8bb00089d54f9f49\gennt.exeFilesize
368KB
MD5345c37943c7a7e1fd0098aab07fe3c86
SHA1ff8d484c90feab90b94502fbcaff84b16eb9a280
SHA2561e0fc6cf4d0b655fc2495aeb3890f382e00ec9060ab23fa0a035a5042cda6daa
SHA512888e8d2f20ccf440107971e8268d06b34aa8c7e5c476f55544321780f30af52c731ada5cca83f015b607f3b61dc5be276199a9dd3cc50fd70ed47c38ca5495cd
-
memory/3476-25-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/3648-17-0x00000000020D0000-0x00000000020DC000-memory.dmpFilesize
48KB
-
memory/3648-21-0x00000000020B0000-0x00000000020B7000-memory.dmpFilesize
28KB
-
memory/3648-27-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4900-0-0x00000000023D0000-0x00000000023DC000-memory.dmpFilesize
48KB
-
memory/4900-4-0x00000000023C0000-0x00000000023CA000-memory.dmpFilesize
40KB
-
memory/4900-5-0x00000000023B0000-0x00000000023B7000-memory.dmpFilesize
28KB