61554022c36d333ad83d78fd23af5bfc3ff037ad334c6ceb35f39a9c0a0a6e10

Analysis

max time kernel
115s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebffca96d28ae2da356ea3c7fc2c61c8_JaffaCakes118.exe
Size

160KB
MD5

ebffca96d28ae2da356ea3c7fc2c61c8
SHA1

64b5fb0bc717893a16b2257aade0fb920f2e0c5c
SHA256

61554022c36d333ad83d78fd23af5bfc3ff037ad334c6ceb35f39a9c0a0a6e10
SHA512

0a16d7d538f6c297bcf137a2967547529084082413397ea62e9cc814d49f7b4c198dc4cf6adfc67d3a213ce1fd49b5638e8a40e5a8ee6324089e3097b5b552f4
SSDEEP

3072:8sDV6Az1lWgFvYGnJd6KKZV3uTN9WU/G9h3Gw590KqWbmzALbvl6:tQAKgFvYGJd6KKZV3uTN9WU/G9h2w591

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	ebffca96d28ae2da356ea3c7fc2c61c8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ebffca96d28ae2da356ea3c7fc2c61c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebffca96d28ae2da356ea3c7fc2c61c8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4152 --field-trial-handle=2304,i,7548677271533893574,11048237606705436109,262144 --variations-seed-version /prefetch:8
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4860-1-0x000000001BF80000-0x000000001C026000-memory.dmp

Filesize
664KB

Download
memory/4860-0-0x00007FFBC3A00000-0x00007FFBC43A1000-memory.dmp

Filesize
9.6MB

Download
memory/4860-2-0x000000001C500000-0x000000001C9CE000-memory.dmp

Filesize
4.8MB

Download
memory/4860-3-0x000000001CA80000-0x000000001CB1C000-memory.dmp

Filesize
624KB

Download
memory/4860-4-0x00007FFBC3A00000-0x00007FFBC43A1000-memory.dmp

Filesize
9.6MB

Download
memory/4860-5-0x00000000019B0000-0x00000000019C0000-memory.dmp

Filesize
64KB

Download
memory/4860-6-0x0000000001710000-0x0000000001718000-memory.dmp

Filesize
32KB

Download
memory/4860-7-0x000000001CBE0000-0x000000001CC2C000-memory.dmp

Filesize
304KB

Download
memory/4860-9-0x00007FFBC3A00000-0x00007FFBC43A1000-memory.dmp

Filesize
9.6MB

Download