d6c13ae93fdcb79687f764b7e9c70aa11516dcefa9b883294a3577d702405baf

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fb9243d698f5e23179ce5a169a581e8_JaffaCakes118.exe
Size

191KB
MD5

4fb9243d698f5e23179ce5a169a581e8
SHA1

d4123a9d4213e54b9c3a3b2bc8b7ebba839d8b38
SHA256

d6c13ae93fdcb79687f764b7e9c70aa11516dcefa9b883294a3577d702405baf
SHA512

9c8cd5d1c1170f6c08f95566e701474b56f087b8df7246b8675f16a62de054c295ce71848ee8730789f67da7fecb3835f29a7342c4cf48b1c536fa161566bda6
SSDEEP

3072:HADWbKzKbQmSVdSme+xmJyD4BliqzsmmEpEmboQd+ccewkyeZyYPuvGCJ30EZ0dh:HAVySV1eY4k437d+4wkTHdS2J

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	4fb9243d698f5e23179ce5a169a581e8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
956	4fb9243d698f5e23179ce5a169a581e8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4fb9243d698f5e23179ce5a169a581e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4fb9243d698f5e23179ce5a169a581e8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads