83659742a26a291f12638c1c52c138f2a094bb97ba557cd0ca8d6242d92566df

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03bc124c1388fbe42b8141e9648fa8ac_JaffaCakes118.exe
Size

7KB
MD5

03bc124c1388fbe42b8141e9648fa8ac
SHA1

6d6d47604c4b6edc92915357ccabc00c9540161b
SHA256

83659742a26a291f12638c1c52c138f2a094bb97ba557cd0ca8d6242d92566df
SHA512

442a211ffb15fc55ce5e311a5c2573761c12b234c2777baa0f2c462d869be8fa6ad864b9a87a11d5c38c461926bb1ec42b462a2b0467b297bbf65fc7e5add39b
SSDEEP

192:Ft5KFUnwR2ITIZLytatWn0NX0N9M9vuaaom:FFnwR2ITIUtaYkkN0W

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	03bc124c1388fbe42b8141e9648fa8ac_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1244	vitra.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1244	3036	03bc124c1388fbe42b8141e9648fa8ac_JaffaCakes118.exe	83
PID 3036 wrote to memory of 1244	3036	03bc124c1388fbe42b8141e9648fa8ac_JaffaCakes118.exe	83
PID 3036 wrote to memory of 1244	3036	03bc124c1388fbe42b8141e9648fa8ac_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\03bc124c1388fbe42b8141e9648fa8ac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03bc124c1388fbe42b8141e9648fa8ac_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\vitra.exe
  "C:\Users\Admin\AppData\Local\Temp\vitra.exe"
  2⤵
  - Executes dropped EXE
  PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vitra.exe

Filesize
8KB

MD5
b1e71eba148bb17f99e51836c7d2a0e2

SHA1
8bdec0c82296322f757114a5f2b56d844b4a0176

SHA256
64a381ea43f06c830dff2611d65c9c3e6973f378a4410994a071ea962ad52a43

SHA512
43aab794aca3ead0cea621c91db46e533762c1f78e50b78723d534f712a65c512fb3ec1400d46de8229e612f5a740cf2b52579bef5f026269abe169b96b1dc86

Download Submit