e5224f6c129aa04503be24ac597830ce034c5e221d462f486941993e81a2ce82

Analysis

max time kernel
92s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1e112e5eece6dcff26ec1b7858b96a2_JaffaCakes118.exe
Size

73KB
MD5

f1e112e5eece6dcff26ec1b7858b96a2
SHA1

dfbaed84a16c293be055837642754cc1b3387e05
SHA256

e5224f6c129aa04503be24ac597830ce034c5e221d462f486941993e81a2ce82
SHA512

a3bd0d8f5bbac0be709278df26355cc63fed25e017d478147d35f78d1747f4914d084a318cd95e1c6a5aced915cabfd637e8ac815bdcd3428cce37e704f053db
SSDEEP

1536:4//6phC0KLs4ECyf9JBi8b0Qwv91YDdkXlAEyRNNz9Yolr:4/+mLqvi8bYKal85YYr

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	f1e112e5eece6dcff26ec1b7858b96a2_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2944	WTemp_01.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WTemp_01.exe	f1e112e5eece6dcff26ec1b7858b96a2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4416	2944	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 2944	3472	f1e112e5eece6dcff26ec1b7858b96a2_JaffaCakes118.exe	85
PID 3472 wrote to memory of 2944	3472	f1e112e5eece6dcff26ec1b7858b96a2_JaffaCakes118.exe	85
PID 3472 wrote to memory of 2944	3472	f1e112e5eece6dcff26ec1b7858b96a2_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f1e112e5eece6dcff26ec1b7858b96a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1e112e5eece6dcff26ec1b7858b96a2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\WTemp_01.exe
  "C:\Windows\WTemp_01.exe"
  2⤵
  - Executes dropped EXE
  PID:2944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 264
    3⤵
    - Program crash
    PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2944 -ip 2944
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\WTemp_01.exe

Filesize
60KB

MD5
3e35caf667f47d46e0b59e99545912db

SHA1
0ddbb102d43434f7ae2f3dcc6ab2994dab69b00e

SHA256
3b9856baa9355a54d5bd15b0aa2dc052ca42686da4fdedfb001054d86514dd3c

SHA512
368605bf7be4e4d1ddf0af70a6a23aa398d7bf5324cdcdb8b6160ad634a3b882fa1902001c0e6ad31c60351fec51df6dc8d639b2cca92b8bc8c474dc971606fa

Download Submit
memory/2944-7-0x0000000010000000-0x0000000010015CC8-memory.dmp

Filesize
87KB

Download
memory/2944-10-0x0000000010000000-0x0000000010015CC8-memory.dmp

Filesize
87KB

Download
memory/3472-8-0x0000000019140000-0x00000000191586B0-memory.dmp

Filesize
97KB

Download