a0c1a7b866dc1504baaa4f328bce6922d491f0c94b3a4a5ed00aaf347d92beb8

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f956a0ee0f39c16ad0b0f7ecde2b6b1f_JaffaCakes118.exe
Size

115KB
MD5

f956a0ee0f39c16ad0b0f7ecde2b6b1f
SHA1

5bd57b8af356f7af32663639aaa88cb8263aec69
SHA256

a0c1a7b866dc1504baaa4f328bce6922d491f0c94b3a4a5ed00aaf347d92beb8
SHA512

baf52028cf2fdfb031f3a5ac8b249ef8e95e40acbd9ea474c4cc6e48318521b11feed5dfd339e291e87e7af91e5a892c8388a265113c8ff7d2cd129d88dba15d
SSDEEP

3072:rvkGO9TMGNG0WycxnvdwOxQZbGL6msFhx2DmRA2:TkGmMGky+iO+GCh0Dkz

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	f956a0ee0f39c16ad0b0f7ecde2b6b1f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1416	4188	f956a0ee0f39c16ad0b0f7ecde2b6b1f_JaffaCakes118.exe	86
PID 4188 wrote to memory of 1416	4188	f956a0ee0f39c16ad0b0f7ecde2b6b1f_JaffaCakes118.exe	86
PID 4188 wrote to memory of 1416	4188	f956a0ee0f39c16ad0b0f7ecde2b6b1f_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\f956a0ee0f39c16ad0b0f7ecde2b6b1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f956a0ee0f39c16ad0b0f7ecde2b6b1f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Crb..bat" > nul 2> nul
  2⤵
  PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Crb..bat

Filesize
238B

MD5
2f60ee2a0a3e2d7a248f59e8a942437d

SHA1
b6750bfe8b956bef882e60ee80d5cd649b28787f

SHA256
4e73c69ea5116649d1e878ec147daeed6fc1db907e00cee481ac04b6bf92a24e

SHA512
e990a6723440db25744bcabe6770c3df7fb5df85fd71f61071f40a623650ed7ca70e18e43034affd94ae8300ae90e56b778fb1b0c641eacc9b67ae45727bab16

Download Submit
memory/4188-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/4188-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4188-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download