04aa7205fb128abb8c29b39c53d7015af568fc70b3615625a1b8a4c8e334bed6

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe
Size 317KB
Sample240603-sce8esbd97
SHA256 04aa7205fb128abb8c29b39c53d7015af568fc70b3615625a1b8a4c8e334bed6
MD5 92313f7fe2df2e2492a7e42a2d176f22
SHA1 26f9c5af4cff5c37f39f799fdc8c9c89938ab190
SHA512 8109540ec1e8ae71237bde30dc43d7d3f0c833ccf8af9e9a243458099dce29df6997c36aba8c9c9bf59006ed21f26891db4f4d33c6902735800aa3d5ac5c24c8
SSDEEP 6144:D3y579pvPx7iLbii5bkgVuN+xSKV7Wkrsf7Ls+1d8H5/fA0ooJ5:jy579hJOXikbkgaISKVesRLRD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
764	42FFF77B-F1C1-443D-A60B-25B52C1D268F.exe

Loads dropped DLL 1 IoCs

pid	Process
5080	92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 764	5080	92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe	90
PID 5080 wrote to memory of 764	5080	92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe	90
PID 5080 wrote to memory of 764	5080	92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe	90
PID 5080 wrote to memory of 3036	5080	92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe	93
PID 5080 wrote to memory of 3036	5080	92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe	93
PID 5080 wrote to memory of 3036	5080	92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\92313f7fe2df2e2492a7e42a2d176f22_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\d2897506-0d7e-4312-b0b2-f23329a516de\42FFF77B-F1C1-443D-A60B-25B52C1D268F.exe
  "C:\Users\Admin\AppData\Local\Temp\d2897506-0d7e-4312-b0b2-f23329a516de\42FFF77B-F1C1-443D-A60B-25B52C1D268F.exe" -y -p96CB0375-E02C-4472-839C-A787C047C727
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\d2897506-0d7e-4312-b0b2-f23329a516de\start.hta
  2⤵
  PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:3796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

42FFF77B-F1C1-443D-A60B-25B52C1D268F.exe

Path C:\Users\Admin\AppData\Local\Temp\d2897506-0d7e-4312-b0b2-f23329a516de\42FFF77B-F1C1-443D-A60B-25B52C1D268F.exe
Size 204KB
SHA256 742a5da340fa3da37a70c21c1a646d2a0e767d1ec099c939d126dcdbaa9a69ed
MD5 9986ed66aa63899ad7f6cef85f9f8742
SHA1 68f24ecfefbf29195710f6dde85f720f42732963
SHA512 9db5add3c1015ef7ef62e270a19d421d076fee4511a16c3ca125046b8f9f4e404b4353e42b32ae1423584706dc49e500b284babaa1b0fbc12bd4827f7431ef2c
SSDEEP 6144:3Lbii5bkgVuN+xSKV7Wkrsf7Ls+1d8H5/y:3XikbkgaISKVesQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lib19997.dll

Path C:\Users\Admin\AppData\Local\Temp\d2897506-0d7e-4312-b0b2-f23329a516de\lib19997.dll
Size 122KB
SHA256 e48c9fbbec71c7c024777cc498d27c4b455eb241e7a42153dc3f7c5aeb2bfedf
MD5 0d1e3567a673d83642b137ff0ffc7b55
SHA1 d294a3481687c29cf1d2ca0a62223f8bb12cd0e9
SHA512 3ce99ed58eeace8b67c1d932677480319191f03bc6da550399e8ccb66fbc49526f80a58c3ee9b1d0de993aa2512809adb25d566b8bf23b7abb7d35e183c6f8f8
SSDEEP 1536:vz303cUb3M70C0LRpNeEHHnoq6ydWrA04FejlB8y9amnb2su0Jhmv4Xc7hEsWjcn:CS0xpoEnW3rT4A8y9VJhU4UZcWooyW
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.gif

Path C:\Users\Admin\AppData\Local\Temp\d2897506-0d7e-4312-b0b2-f23329a516de\loader.gif
Size 1KB
SHA256 379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb
MD5 e88ebd85dd56110ac6ea93fe0922988e
SHA1 684a31d864d33ff736234c41ac4e8d2c7f90d5ae
SHA512 211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7
MD5 SHA1 SHA512

Submit Download

start.hta

Path C:\Users\Admin\AppData\Local\Temp\d2897506-0d7e-4312-b0b2-f23329a516de\start.hta
Size 1KB
SHA256 6e8fcc04c8bf6e07448f7bd47cb304f374873045355b66e160db965ca9685f34
MD5 9bbdda852677117290a7a3f130638079
SHA1 48390e93abf77599ae64023160cb8ae143189777
SHA512 1d94b9074ac16cc84b76209a258313282437019838c6b759f8e1c9a665ea104b1e5d197c42b5896b4d89fe7087501017d13a5912272084592c5a218dc635aaa9
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads