e1497fdc141ec6db3bf03a6df176c51b11443895dbe8f02abd7a874454dfa621

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe
Size

116KB
MD5

fcd97c39ece3d921ef167515efb5ba15
SHA1

4a8d7e10b9018c92d9bb338152df8a4333936839
SHA256

e1497fdc141ec6db3bf03a6df176c51b11443895dbe8f02abd7a874454dfa621
SHA512

85ac0701ae3389413f8957b89e772b3d11375f9ef73e072dfb0b01dfde52d425b4cc15d11726ab6468dec57ba8878bc216720e87b978ad82c9f500dff8d77379
SSDEEP

1536:e8MFN7qNlfNe+zLipk+JOmuvBGVa/TYareDRRdauTZ8yEnm+Ad4gricMsR:Cb7q71LzLikOupGVgeDsuTZAo4lsR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2280	2476	fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe	104
PID 2476 wrote to memory of 2280	2476	fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe	104
PID 2476 wrote to memory of 2280	2476	fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe	104

C:\Users\Admin\AppData\Local\Temp\fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Spv..bat" > nul 2> nul
  2⤵
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Spv..bat

Filesize
238B

MD5
135734325998f8ccad9e39473c0420cf

SHA1
40d63174c6da265f540f9eabbbb9b23b29587d2d

SHA256
7cb8fea3b052e201bfc24deb1086e6c69268d2d814643f678c49158ce50b861f

SHA512
4da6c3a2923dcb271d53cb6a69e13ea6e1a44882e994c0475319ae93ee8e031da8aa3314177bef8fac05f2179f68d10d3012731db58defc9980fe71f52a883f0

Download Submit
memory/2476-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2476-1-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download
memory/2476-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2476-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download