f6239b94e762b18562eba6eef4ef5eafc10e59b55855b89f705612d07d453245

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

019a12aa79e40933f9d2df21eea4b71b_JaffaCakes118.exe
Size

48KB
MD5

019a12aa79e40933f9d2df21eea4b71b
SHA1

0cd313af612359eda381c1ddfb6d4520f37ee71d
SHA256

f6239b94e762b18562eba6eef4ef5eafc10e59b55855b89f705612d07d453245
SHA512

a07540b1d395ed33d8be0e8e2bcca05b1b5a88a24e758fa750b7c440976200ffc23f6443d129ce551e811ffa2dbc984135c719b9adda618b7239dde570bb4cbd
SSDEEP

768:HT1g40wSXvdMx+v3fUFqFRFo6kF7xNvCMUM33ScGyTjUOXRyrny:Hxg2SfdMw3KeE52ayEjd

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	019a12aa79e40933f9d2df21eea4b71b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3748	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 3748	1892	019a12aa79e40933f9d2df21eea4b71b_JaffaCakes118.exe	86
PID 1892 wrote to memory of 3748	1892	019a12aa79e40933f9d2df21eea4b71b_JaffaCakes118.exe	86
PID 1892 wrote to memory of 3748	1892	019a12aa79e40933f9d2df21eea4b71b_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\019a12aa79e40933f9d2df21eea4b71b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\019a12aa79e40933f9d2df21eea4b71b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
48KB

MD5
4afda6b93f2b208af69beb88060f87a8

SHA1
1c55dcfcc82eaea3f6ee41851ba40c0e1630e2e5

SHA256
4413b56989e06d3e71501aa5002f31553e9d3e5f8d5214ad8228ed12df3183c2

SHA512
197b3fc81ee694ef55ee99a56b1f58c01b68a777cbfb6e35fc7a90d8dc57348147e3bf4f6b8452d44ecbf18a992b02ca5910c7c84b613082c53f9c5ac040797c

Download Submit