869b755e5838441f265d88fbcabea82fe29437651e8effbc0710efec2a74e9cc

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f75ef4da61b731c738054f1849506ef7_JaffaCakes118.exe
Size

2.0MB
MD5

f75ef4da61b731c738054f1849506ef7
SHA1

f098ac040a1112c612231c47147d2a6a5c6c3e59
SHA256

869b755e5838441f265d88fbcabea82fe29437651e8effbc0710efec2a74e9cc
SHA512

945cbbdc1850b709ee00e2a448b2eeefb7aa1c675d46a58115d576dca18a4615ec1c58b2b1995b55fff76529ebe1e953069946efaa99b2132bf9047d8af32283
SSDEEP

24576:YYz7a8543siToh7Q2gcI0xGL4C27gVp6TWgW/JDiZEGI4r6VpXyWEV+Q0WbO/Kif:c859hCFp6TWgWxw+XyWEV4qir4HQqfc

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	f75ef4da61b731c738054f1849506ef7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2688	wrar342crystal.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2796-0-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/files/0x0009000000023411-5.dat	upx
behavioral2/memory/2688-10-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/2796-11-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral2/memory/2688-12-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2688	wrar342crystal.exe
2688	wrar342crystal.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2688	2796	f75ef4da61b731c738054f1849506ef7_JaffaCakes118.exe	89
PID 2796 wrote to memory of 2688	2796	f75ef4da61b731c738054f1849506ef7_JaffaCakes118.exe	89
PID 2796 wrote to memory of 2688	2796	f75ef4da61b731c738054f1849506ef7_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\f75ef4da61b731c738054f1849506ef7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f75ef4da61b731c738054f1849506ef7_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\wrar342crystal.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\wrar342crystal.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\wrar342crystal.exe

Filesize
1.8MB

MD5
292c45438bcd5265889289ef5a984f8a

SHA1
caaef06649f8025946c61dc608e18e5312a1c185

SHA256
ad81f49aad8cfe3bccff2285fc344c6fd3b02223f6ad73518b12f8ec67818107

SHA512
aabc45c17a98c5304c9fa65e0a122c875df7c50b84287a8319efd8b607aa6fd040654be3f65cd8f2970bfa939147bcf19369c5e8efff393979a19c1d420dd1c7

Download Submit
memory/2688-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2688-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2796-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2796-11-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download