f808a52cd978ca9173f82e323204f0a0848054259b0ff0e2927a9780c9658bc1

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e15461eee6e526b292f48850fe06eab_JaffaCakes118.exe
Size

41KB
MD5

0e15461eee6e526b292f48850fe06eab
SHA1

fb8061749928f85999e91693afa8f32b321c18bc
SHA256

f808a52cd978ca9173f82e323204f0a0848054259b0ff0e2927a9780c9658bc1
SHA512

93ea9870ec4f92b619ba35c31ae3c90ec39e4d6821f252f2483b31ec4fd15a18bc662dccffda0c8d2752a1e4faa031ab73bcfb18298f5943dedfdde307a7d4dc
SSDEEP

384:DBXkocaoPBX5Yq5aN6i/U6eDQgBpGVXpvhVstxxrzaasXwLlx:DKPPQYaN67hQCGVX3EHvazXwLz

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	0e15461eee6e526b292f48850fe06eab_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
776	hromi.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1180-0-0x0000000000400000-0x00000000004092E7-memory.dmp	upx
behavioral2/files/0x0006000000023298-5.dat	upx
behavioral2/memory/1180-9-0x0000000000400000-0x00000000004092E7-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 776	1180	0e15461eee6e526b292f48850fe06eab_JaffaCakes118.exe	82
PID 1180 wrote to memory of 776	1180	0e15461eee6e526b292f48850fe06eab_JaffaCakes118.exe	82
PID 1180 wrote to memory of 776	1180	0e15461eee6e526b292f48850fe06eab_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0e15461eee6e526b292f48850fe06eab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e15461eee6e526b292f48850fe06eab_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\hromi.exe
  "C:\Users\Admin\AppData\Local\Temp\hromi.exe"
  2⤵
  - Executes dropped EXE
  PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hromi.exe

Filesize
41KB

MD5
5d4cb17672624a25e8c2204afca82210

SHA1
d547f101e03c6d16cd40d18942ce49e951c581d8

SHA256
f21fa6756bbd68d13eb4fe5a45f5052e8666d0cd791d356a463eb7b7e6987d37

SHA512
b862592b9318b434f170d927f098c59d21902df2a21694d4ae438074d9233ce5188fb690996a96cb34f229192a123594194fcb0ea5cd7686579abdd1eaa9d3cf

Download Submit
memory/1180-0-0x0000000000400000-0x00000000004092E7-memory.dmp

Filesize
36KB

Download
memory/1180-9-0x0000000000400000-0x00000000004092E7-memory.dmp

Filesize
36KB

Download