68057b3db60624a0eb70b73e220bb3ce6ea106a2e7b22e97a1d0dd1b5c72fdb0

Analysis

max time kernel
141s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe
Size

17KB
MD5

fa98e9fc0f35dc36b327752447df84b7
SHA1

bfdf0f38db4ca9c914a6d31d3da152984e6f55a1
SHA256

68057b3db60624a0eb70b73e220bb3ce6ea106a2e7b22e97a1d0dd1b5c72fdb0
SHA512

ccedad481d9509629c4358acddae9c7b51b47b982f721c8be872bffbfa71a192f600d69e30dc3dbb0a56f8e5b06a89ebf6302c32199ee26f10f5e6993d82bd8a
SSDEEP

384:PwlApAQ2fy9FY4mNxKMKbVVr3rcC3OiEXqJ6lXEX2TtW3k:Ils2fy9FrCKbV5cziE6MlXEO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4548	4628	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe	93
PID 4628 wrote to memory of 4548	4628	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe	93
PID 4628 wrote to memory of 4548	4628	fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa98e9fc0f35dc36b327752447df84b7_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_cls0.bat" "
  2⤵
  PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_cls0.bat

Filesize
302B

MD5
ba05ea27db899608a76a0041a556e782

SHA1
0e0d172e1f270e213d49eda5f19a65c7bc6acf28

SHA256
2ff2432acc631c9528ef161e8ce24c3ded1fe46218ba4ad361ed58e01843ed18

SHA512
d3ec7799765dc0443a90ac24d2a35dd0a93f711bfce85362906a1144cf4f57bbd8c30b9355a6204d52d6e8445c84da8b90a38cdb8efdda58a2dbd98f7ec6d842

Download Submit