ebb565ed7bf2441b35f79ba0b2a8fc8a2f87337a4ae5239f737b71b0c572f3e4

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2186aaee50961e6c2a899d1139022b9_JaffaCakes118.exe
Size

39KB
MD5

f2186aaee50961e6c2a899d1139022b9
SHA1

1327b3341f7c6e61cf533999ba8eccb7713c4437
SHA256

ebb565ed7bf2441b35f79ba0b2a8fc8a2f87337a4ae5239f737b71b0c572f3e4
SHA512

eeecbe3216c38155f7d41de8e59efc77f7717a001630a67f7a8a3a98a9a2b81b1aca254502cfcebfcb3335fe1af4e2704e04450778b56751028341e005f56876
SSDEEP

768:/VhR61d2hyKIDMi5FazjmilAA8/wv3pclKu:jed2ZFX/8/w6

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	f2186aaee50961e6c2a899d1139022b9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3592	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 3592	4108	f2186aaee50961e6c2a899d1139022b9_JaffaCakes118.exe	86
PID 4108 wrote to memory of 3592	4108	f2186aaee50961e6c2a899d1139022b9_JaffaCakes118.exe	86
PID 4108 wrote to memory of 3592	4108	f2186aaee50961e6c2a899d1139022b9_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\f2186aaee50961e6c2a899d1139022b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2186aaee50961e6c2a899d1139022b9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
39KB

MD5
e9967cdf8dc3f5e221fb573cc8d2dcb4

SHA1
1c326f5cca35bab513fb1ac43b132c75641fd1a5

SHA256
ad71f59009e774b44f55cb603ada3292f167d877683363d8c184d2f87f2d143e

SHA512
4a37663d02a864b20ed0a546664cba4ee63a3614477cf1f4c8a66115b2f6d1bb96739d450f1b5f6ad0e425dba6a97b8d959263c4a3ea5714fb027f1926e9328c

Download Submit