87b2bc28a51ba69bf33a29b6409e70faaa2ddc9d6dead45a432804fe3ba31a60

Analysis

max time kernel
51s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe
Size

317KB
MD5

9b8bcdcf51cf889240b33561cce1a5e6
SHA1

4509bfd2aa3ef5366fca5386f8e70677b7c487fb
SHA256

87b2bc28a51ba69bf33a29b6409e70faaa2ddc9d6dead45a432804fe3ba31a60
SHA512

027e4129dc0b61b4bce01c399df7378f013b5f0291ecf58b1c0183a2fe7750cf8a79670a661d85b07a1c0b9e7b912af263eacb11978075d38795e44ad7abf59c
SSDEEP

6144:H2yYM47toLbii5bkgVuN+xSKV7Wkrsf7LsgEyd+xhsB3anw73/:H2yYM47qXikbkgaISKVAfd+h1nw7P

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2944	BB8F0E80-0152-4DB4-9AF7-B46951F0682D.exe

Loads dropped DLL 1 IoCs

pid	Process
4276	9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 2944	4276	9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe	82
PID 4276 wrote to memory of 2944	4276	9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe	82
PID 4276 wrote to memory of 2944	4276	9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe	82
PID 4276 wrote to memory of 3328	4276	9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe	85
PID 4276 wrote to memory of 3328	4276	9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe	85
PID 4276 wrote to memory of 3328	4276	9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9b8bcdcf51cf889240b33561cce1a5e6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\b934ae88-727a-4e60-bef9-948b0c2ee8a9\BB8F0E80-0152-4DB4-9AF7-B46951F0682D.exe
  "C:\Users\Admin\AppData\Local\Temp\b934ae88-727a-4e60-bef9-948b0c2ee8a9\BB8F0E80-0152-4DB4-9AF7-B46951F0682D.exe" -y -p5DE0920C-D72F-46C7-994A-D313C1A7D219
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\b934ae88-727a-4e60-bef9-948b0c2ee8a9\start.hta
  2⤵
  PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b934ae88-727a-4e60-bef9-948b0c2ee8a9\BB8F0E80-0152-4DB4-9AF7-B46951F0682D.exe

Filesize
204KB

MD5
d7509408c35d8f69d3e8056b63eb7cfd

SHA1
745834408da9b615df00a16aaadb91beae15debf

SHA256
1b78f9c451c402c27ca152ba062290f5a876f7ec523d5a9b9f98fdc9250bdc6c

SHA512
cf32f13832271cd940aa38f1557a6669917a244fdc5d9cdad93fc80f35184da566fc52fd4d502f5fa87e3de13da59ad0e3b8368e934eedffb79b8e63af8f5759

Download Submit
C:\Users\Admin\AppData\Local\Temp\b934ae88-727a-4e60-bef9-948b0c2ee8a9\lib.dll

Filesize
122KB

MD5
c63b74ec398f53c6ad2878a05988dd55

SHA1
9a5c03ec1f8e0df0e8cbad5027aec121b42a0509

SHA256
c5d178e025d2d7abc108ba977e29557510b4ecc4acc1a48e76285fa0157b9986

SHA512
9e861b01c15dabb05736be9f8f8deb763f67dc94f33df15aa6334f5973e46665641c935e271029a72d8e78e79b122d07cd93cbbe6a188dbe70aa656673258189

Download Submit
C:\Users\Admin\AppData\Local\Temp\b934ae88-727a-4e60-bef9-948b0c2ee8a9\loader.gif

Filesize
1KB

MD5
e88ebd85dd56110ac6ea93fe0922988e

SHA1
684a31d864d33ff736234c41ac4e8d2c7f90d5ae

SHA256
379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

SHA512
211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\b934ae88-727a-4e60-bef9-948b0c2ee8a9\start.hta

Filesize
1KB

MD5
9bbdda852677117290a7a3f130638079

SHA1
48390e93abf77599ae64023160cb8ae143189777

SHA256
6e8fcc04c8bf6e07448f7bd47cb304f374873045355b66e160db965ca9685f34

SHA512
1d94b9074ac16cc84b76209a258313282437019838c6b759f8e1c9a665ea104b1e5d197c42b5896b4d89fe7087501017d13a5912272084592c5a218dc635aaa9

Download Submit