1532d510863babf2935e0f3e6ffcf56140c92260d4f0ecf6cb1f0125868d8838

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe
Size

361KB
MD5

6932af630f2ffbd2267a4b8576a33e6a
SHA1

6c113c6ab957fc188ffee30232f2481b9636402e
SHA256

1532d510863babf2935e0f3e6ffcf56140c92260d4f0ecf6cb1f0125868d8838
SHA512

f83aad3753e84c79b9ac666ace4321c1162c363da6c254178976a2f3d9a08af38eba0ae0a477b2567d9cc73b616ee302f3d1eada48d6b8400dc26a42fe4e379d
SSDEEP

6144:rgU633ZwSmJy7Lbii5bkgVuN+xSKV7Wkrsf7Lss2dA+wp5lUjpWUkZrpyN:rgJZwSmJSXikbkgaISKVM2dUU8U4i

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

6E771AFE-39D4-4D0F-B167-2F0222A28662.exe

pid process

1820 6E771AFE-39D4-4D0F-B167-2F0222A28662.exe
Loads dropped DLL 1 IoCs

Processes:

6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe

pid process

3244 6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1820	6E771AFE-39D4-4D0F-B167-2F0222A28662.exe

pid	process
3244	6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe

description	pid	process	target process
PID 3244 wrote to memory of 1820	3244	6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe	6E771AFE-39D4-4D0F-B167-2F0222A28662.exe
PID 3244 wrote to memory of 1820	3244	6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe	6E771AFE-39D4-4D0F-B167-2F0222A28662.exe
PID 3244 wrote to memory of 1820	3244	6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe	6E771AFE-39D4-4D0F-B167-2F0222A28662.exe
PID 3244 wrote to memory of 808	3244	6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe	mshta.exe
PID 3244 wrote to memory of 808	3244	6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe	mshta.exe
PID 3244 wrote to memory of 808	3244	6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe	mshta.exe

C:\Users\Admin\AppData\Local\Temp\6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6932af630f2ffbd2267a4b8576a33e6a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3244

C:\6920a852-10a2-4bef-837f-279598cea839\6E771AFE-39D4-4D0F-B167-2F0222A28662.exe
"C:\6920a852-10a2-4bef-837f-279598cea839\6E771AFE-39D4-4D0F-B167-2F0222A28662.exe" -y -pA1B35B39-8CA9-4680-93E6-AD4DAF20843E
2⤵
- Executes dropped EXE
PID:1820

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" c:\6920a852-10a2-4bef-837f-279598cea839\start.hta
2⤵
PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\6920a852-10a2-4bef-837f-279598cea839\6E771AFE-39D4-4D0F-B167-2F0222A28662.exe

Filesize
208KB

MD5
195cee9d61fd76a49aa1edd71dd0b7f9

SHA1
48e1ab87cd6b1cfddf7209de2f132a058149b2c5

SHA256
d55160dae4bcb3900c7ee359b2f5507f013675761097897800819bb4416a71f6

SHA512
c50f8a9c8dd11853e929e678ce3066ea6e12b3a941a2dc820f929bb2e08cbe6880183fccfbc1ddab1d5200a5d43ef79323ab28dd8b95eb4d76bec91a28b5a498

Download Submit
\??\c:\6920a852-10a2-4bef-837f-279598cea839\InstallerHelper.dll

Filesize
132KB

MD5
1f247324cd6ee90c3549c928591d050e

SHA1
e43a203200e95a39d90d0c5cad590b1fa7cb3e81

SHA256
a4df5dc4ee0a427300f3a6c2d5794b28527fad9e0542ee310f64979e37e74805

SHA512
4a3caeb32c4be0637dcf7c8bf14ac85b2132ec705a3069fbb6c94813417b96786a4687aaa81017c301660946eae1d2debddac7cd1fa4fecac48cf6655279518c

Download Submit
\??\c:\6920a852-10a2-4bef-837f-279598cea839\loader.gif

Filesize
1KB

MD5
e88ebd85dd56110ac6ea93fe0922988e

SHA1
684a31d864d33ff736234c41ac4e8d2c7f90d5ae

SHA256
379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

SHA512
211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

Download Submit
\??\c:\6920a852-10a2-4bef-837f-279598cea839\start.hta

Filesize
1KB

MD5
db4ada697fa7a0e215281533d52578e9

SHA1
fb755ea8371edf5065dc53e21eb413603f9eba7f

SHA256
f949fd6ca734830572128b4348dfd039419140c7ef501d80773f71ca3f0ed78c

SHA512
9ba1d2658785dd3c88b4399132f8330dc58872235e19ca9854b0e453d8cc7a58de0c8be84da376a72b5851073f531c95b2c6afa84f43053561ca8e6751d6e2f3

Download Submit