45a849fa4ef1b773b809d545a7f015e4c995ff9799acdab80d77888ebe0d372b

Analysis

max time kernel
143s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe
Size

14KB
MD5

fe5f76685e07fb58437dae6c77b0a830
SHA1

a595c084356960c093de81cc75fa44796c16af5d
SHA256

45a849fa4ef1b773b809d545a7f015e4c995ff9799acdab80d77888ebe0d372b
SHA512

a71af1bab6c0789c54bd25d277be965f1a2b98fd2d9d5f37f8421ea4abfc44e3e2bb5cb0bc71f331b8d549a7d91ceaef2b36c5996e5b22f7780d0211a8ef75dd
SSDEEP

384:WpctE/I+hjbqitkaaCNwkQH4DYUkCcarPML1sK:WpctEQ2qitkUwkQH4DYUkeML

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl\CLSID	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4428	4764	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	100
PID 4764 wrote to memory of 4428	4764	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	100
PID 4764 wrote to memory of 4428	4764	fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe5f76685e07fb58437dae6c77b0a830_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\awer0.bat" "
  2⤵
  PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\awer0.bat

Filesize
302B

MD5
9958174c9177b418d7eb651a96b41354

SHA1
8e0ea441d3f91c040e770aecc73d85e29c3ee45b

SHA256
00afc7fb5451c7f7fdf8118192dff7aadef4928b9adbcdb1f6d7b30726bd00ca

SHA512
6a153e6a9cc6347a2fc502b878b092f63071906090a4ad1df37ab82ee008c7b9a7b5ebda5ea56f752560c3c1faa5eaab035006cf34d960884bee4572eb001f25

Download Submit