21748b97eae16be2e2746fcc6bcefa54a7a7950052c635f2270c7e9b822161a0

Analysis

max time kernel
142s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.exe
Size 2.7MB
Sample240528-rbfbcshd69
SHA256 21748b97eae16be2e2746fcc6bcefa54a7a7950052c635f2270c7e9b822161a0
MD5 7d37eaf0ce4e777f9e0cefced02c8851
SHA1 3c1386c4a431597e5f4dd6cd2191a529b6cafcf6
SHA512 d9f116c10cce4835787af9b674cf405108a62f0ab2b61fb1f20e857732286e2b8e14e1b039e27e42ecfe900d3911b9979df42b31c6d1f712a683ee028c0e4b1f
SSDEEP 49152:v23GvSHZujfvY8vvBm0TZB16pI0a8cFsY4dHgL4k059lJWldbPBI1rm:u3G6HZujfvZvvBm0TZBKIzQM0PWnbP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.tmp

Executes dropped EXE 2 IoCs

pid	Process
2772	7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.tmp
4884	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
2772	7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4884	setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 2772	5084	7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.exe	81
PID 5084 wrote to memory of 2772	5084	7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.exe	81
PID 5084 wrote to memory of 2772	5084	7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.exe	81
PID 2772 wrote to memory of 4884	2772	7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.tmp	82
PID 2772 wrote to memory of 4884	2772	7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.tmp	82
PID 2772 wrote to memory of 4884	2772	7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.tmp	82

C:\Users\Admin\AppData\Local\Temp\7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\is-5B5EK.tmp\7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5B5EK.tmp\7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.tmp" /SL5="$D0050,2424478,153088,C:\Users\Admin\AppData\Local\Temp\7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\is-1CP73.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-1CP73.tmp\setup.exe" /path="C:\Users\Admin\AppData\Local\Temp\7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-1CP73.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

default.xml

Path C:\Users\Admin\AppData\Local\Temp\is-1CP73.tmp\default.xml
Size 1KB
SHA256 1c37df879ed58ee90242e2ce99df639dffbe71d06d2fbeb588c26238fe7e6c2d
MD5 b43edbfaaf6f9d5be992ec264220cde3
SHA1 119b12e4c06dc5f08b63ed59174ca4bb36def8e9
SHA512 c2692827ee3b3767c30f5abdf6e47774cd5417ef2c5121bc5586b1fa73508dde24dbc0c315d27ed8a37c5df61fe4326dc39d5562423d905b0713898121ddb9dd
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-1CP73.tmp\setup.exe
Size 4.4MB
SHA256 2ee2117a76c7788dbda760a1ff2760b139cf7119d2eef65ed15f093191599d04
MD5 db748ee04da45429f9761f3e2c106e08
SHA1 b07c5102eeb80c825ed94d5aeb96439de128514a
SHA512 74c5065ff6e4f04a88931366317f412a3d33c4b4d064941fe14cadcc6d4f3efd904344a0079f81aa04bf579536e4280d75b6bed5c325327315cdcfea6a8ae81c
SSDEEP 49152:MqvRWhBUSprzRIV7/imlZ84tlcW06QJTFTiTkuAddxI9EL+gg5ctY+Tc1Ekn8RAj:MxhFIV7BZNi64TYZbVX
MD5 SHA1 SHA512 SSDEEP

Submit Download

7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-5B5EK.tmp\7d37eaf0ce4e777f9e0cefced02c8851_JaffaCakes118.tmp
Size 1.1MB
SHA256 15a76f12bc30719f5ee92536806d7031258e5a355b0db32fab705eb100b50578
MD5 abe7f4b9ca2627d3450d0a2d97a3069c
SHA1 018d04be220103440d4d56bb47897dc96da82ced
SHA512 65f6f1fdf8315fe183d40d9f9398a50683cba065b91d29a00c9d3cfab7e8b9719d172c83895810f8a988cc7c35614136d7ffcc6a1f62f420f2c36eeeb5b2d213
SSDEEP 24576:Gh+EpSGP3ZEgRhuRKOODz6HY1SC9s6WcREFydry9uZHx9Uv:Ea+P6HpcTdn/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2772-7-0x0000000000400000-0x0000000000529000-memory.dmp

Download

memory/2772-28-0x0000000000400000-0x0000000000529000-memory.dmp

Download

memory/4884-25-0x0000000000400000-0x00000000008FE000-memory.dmp

Download

memory/4884-29-0x0000000000400000-0x00000000008FE000-memory.dmp

Download

memory/5084-0-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/5084-2-0x0000000000401000-0x0000000000417000-memory.dmp

Download

memory/5084-27-0x0000000000400000-0x0000000000430000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads