e05fcfcba820d74885346ca7c3c0c207d48df77d61531585a937cf9deec1c26f

Analysis

max time kernel
135s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2b0748a7cbaec1b02ec3e47eece9f56_JaffaCakes118.exe
Size

100KB
MD5

f2b0748a7cbaec1b02ec3e47eece9f56
SHA1

034bee1f5f0de1a8556ab11c85db90e86136e343
SHA256

e05fcfcba820d74885346ca7c3c0c207d48df77d61531585a937cf9deec1c26f
SHA512

3044830df4609c0cc7ce761f65d49c31e3070f305b213c63843396ed94a83066d8db8225271bdc53244c4a1884d01aabc088783ad575df7ca63f6a623a81d094
SSDEEP

1536:SzxcMPWYfQxJVgux399nGBKMDwgWsrsm94x1Vg98uPGUt8bfgwlSU6bCz2gCzuYU:SrWAQxEux8tDisuyRPGUt8E4+ktY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	f2b0748a7cbaec1b02ec3e47eece9f56_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 436	4592	f2b0748a7cbaec1b02ec3e47eece9f56_JaffaCakes118.exe	92
PID 4592 wrote to memory of 436	4592	f2b0748a7cbaec1b02ec3e47eece9f56_JaffaCakes118.exe	92
PID 4592 wrote to memory of 436	4592	f2b0748a7cbaec1b02ec3e47eece9f56_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\f2b0748a7cbaec1b02ec3e47eece9f56_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2b0748a7cbaec1b02ec3e47eece9f56_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Qxb..bat" > nul 2> nul
  2⤵
  PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Qxb..bat

Filesize
238B

MD5
8bf4fdf3b3228dc7e7e1a30fea2699e3

SHA1
ebc5529dc0d1294f338bfd2d6aaeb2fe23eac344

SHA256
62c66d383856a94731134b2fce65bbb6bb29e20cc0c8b4f1c05f86c830f1846d

SHA512
ec22ccd4a2dd395ff958f092d1c22d3a62f05d6395b0da66dcb4d200cd1d61dd306e65efd560268a6926b7156506b065e52dab5c54fef0d20937f2b58b78af06

Download Submit
memory/4592-0-0x00000000009C0000-0x00000000009D1000-memory.dmp

Filesize
68KB

Download
memory/4592-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4592-3-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download