dce53cefafaabb7c4d50e19d8c352bdaca304f6ec07a2eb87cf77cf29e42fba7

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe
Size 317KB
Sample240502-ke9k2sfd24
SHA256 dce53cefafaabb7c4d50e19d8c352bdaca304f6ec07a2eb87cf77cf29e42fba7
MD5 0e0091bc67dfa8e6a6ba3e78766d1fc6
SHA1 2b024ad22b0fda674e9b38e0f90c5bf2cf0defc0
SHA512 0713b4b76207c4592f8b0b03bffc60e8487ab3b662639fa223425afaaa5a4da50ad010b8b78f8e6f4bdf8c6beabda9186c24af88f1b140d97a0478c9586fdce8
SSDEEP 6144:+0YjywDhq1doBLbii5bkgVuN+xSKV7Wkrsf7LsOSfXVB8KC9bwd:+0AywDhwdiXikbkgaISKVJXv8z9q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1424	ACFEB1DF-5926-4B62-AB80-BF84B853CBD3.exe

Loads dropped DLL 1 IoCs

pid	Process
4860	0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1424	4860	0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe	81
PID 4860 wrote to memory of 1424	4860	0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe	81
PID 4860 wrote to memory of 1424	4860	0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe	81
PID 4860 wrote to memory of 4348	4860	0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe	85
PID 4860 wrote to memory of 4348	4860	0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe	85
PID 4860 wrote to memory of 4348	4860	0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e0091bc67dfa8e6a6ba3e78766d1fc6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\310829ec-b9c9-4b04-8470-db3d5dab7b1b\ACFEB1DF-5926-4B62-AB80-BF84B853CBD3.exe
  "C:\Users\Admin\AppData\Local\Temp\310829ec-b9c9-4b04-8470-db3d5dab7b1b\ACFEB1DF-5926-4B62-AB80-BF84B853CBD3.exe" -y -p30C57DBF-B95B-41E3-AC15-6157AD2482D4
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\310829ec-b9c9-4b04-8470-db3d5dab7b1b\start.hta
  2⤵
  PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACFEB1DF-5926-4B62-AB80-BF84B853CBD3.exe

Path C:\Users\Admin\AppData\Local\Temp\310829ec-b9c9-4b04-8470-db3d5dab7b1b\ACFEB1DF-5926-4B62-AB80-BF84B853CBD3.exe
Size 204KB
SHA256 1b81876a2bc0a704a290d120a9c7602242458ae0ca1ddf7e07035795acd46357
MD5 a1a843901ee01d5c31a928348389fc07
SHA1 f76866220943028a927b8dc8f54620cb0dd41f2e
SHA512 aa24002104e9f064fa23da297989b0187ec2e79661e2d80a29f244d727c7ebbce9b44d46f966d84edae2fb64b6d25a4d1f968ab8c0e65a578a09b1915d5f963a
SSDEEP 6144:3Lbii5bkgVuN+xSKV7Wkrsf7LsOSfXVB8Kp:3XikbkgaISKVJXv82
MD5 SHA1 SHA512 SSDEEP

Submit Download

helper76978.dll

Path C:\Users\Admin\AppData\Local\Temp\310829ec-b9c9-4b04-8470-db3d5dab7b1b\helper76978.dll
Size 122KB
SHA256 e8176dcf60d23548af81ed56a7772c0901eb4f962d7921ad8a0e99741e2b97c0
MD5 b3a99f2a72af563cf6dd5f46a55d162f
SHA1 b89a64ed854d6cd18b81f4d5e084915037ec83b9
SHA512 0fdf9e259fc9581e3add9b852d8ff2d12f1e583576bef9c449645e3b5ecf1ec8cccb1771ccb9afb569dbbd61d122c2b2db7d71cc2c2de298234915ca6a5bd578
SSDEEP 1536:Z3lV0snCduczBVb74ACgBHXsys8GNZmnDAkoadmnVJsu0/PkBXc6m1sWjcdLZsuL:HuBOADB8c4mnD0aH/PkBQ6LZjL
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.gif

Path C:\Users\Admin\AppData\Local\Temp\310829ec-b9c9-4b04-8470-db3d5dab7b1b\loader.gif
Size 1KB
SHA256 379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb
MD5 e88ebd85dd56110ac6ea93fe0922988e
SHA1 684a31d864d33ff736234c41ac4e8d2c7f90d5ae
SHA512 211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7
MD5 SHA1 SHA512

Submit Download

start.hta

Path C:\Users\Admin\AppData\Local\Temp\310829ec-b9c9-4b04-8470-db3d5dab7b1b\start.hta
Size 1KB
SHA256 6e8fcc04c8bf6e07448f7bd47cb304f374873045355b66e160db965ca9685f34
MD5 9bbdda852677117290a7a3f130638079
SHA1 48390e93abf77599ae64023160cb8ae143189777
SHA512 1d94b9074ac16cc84b76209a258313282437019838c6b759f8e1c9a665ea104b1e5d197c42b5896b4d89fe7087501017d13a5912272084592c5a218dc635aaa9
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads