cf2b5bae70e38534e7863029abf76c7282c0e1f2cb73975e8c80301a427f0883

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c9d881d75d2b4b23ee7f4a3d97493ef_JaffaCakes118.exe
Size 34KB
Sample240611-b5drmazajf
SHA256 cf2b5bae70e38534e7863029abf76c7282c0e1f2cb73975e8c80301a427f0883
MD5 9c9d881d75d2b4b23ee7f4a3d97493ef
SHA1 2aca557f163882bf024c6d58f4d1e4d7c1f4c944
SHA512 f0da4e83ec0ca760fb62a40099f8783015e0c59329e3e51a355764b7ef8a63c16987ebd1d5a564150b430cdadb74e07cd7bf45557ddb356ca62331b8a0f22866
SSDEEP 384:DBXkocaoPBX5Yq5aN6i/U6eDQiHZ0t4wp:DKPPQYaN67hQ4sXp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	9c9d881d75d2b4b23ee7f4a3d97493ef_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	hromi.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1152-0-0x0000000000400000-0x00000000004092E7-memory.dmp	upx
behavioral2/files/0x0008000000022f51-5.dat	upx
behavioral2/memory/1152-9-0x0000000000400000-0x00000000004092E7-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2660	1152	9c9d881d75d2b4b23ee7f4a3d97493ef_JaffaCakes118.exe	82
PID 1152 wrote to memory of 2660	1152	9c9d881d75d2b4b23ee7f4a3d97493ef_JaffaCakes118.exe	82
PID 1152 wrote to memory of 2660	1152	9c9d881d75d2b4b23ee7f4a3d97493ef_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\9c9d881d75d2b4b23ee7f4a3d97493ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9c9d881d75d2b4b23ee7f4a3d97493ef_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\hromi.exe
  "C:\Users\Admin\AppData\Local\Temp\hromi.exe"
  2⤵
  - Executes dropped EXE
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hromi.exe

Path C:\Users\Admin\AppData\Local\Temp\hromi.exe
Size 34KB
SHA256 2b9572bffd667fb223b4b6f4982707374b8813e1e71956694f3fa205be4e4856
MD5 bfd0401fa8bb600f6b3fdee392523e79
SHA1 58251b5d86e6e183bf2958d865230aa7eb6377b9
SHA512 cdc9ca60306a5cbf3f09b2f876f0ad815d4bc352a561cfb40bae9bf1c081e3a9d334caa29e217064dc5a040147c2dfe11c9d2914fe1e2cba8a0346be2901de46
SSDEEP 384:DBXkocaoPBX5Yq5aN6i/U6eDQiHZ0t4wQ:DKPPQYaN67hQ4sXQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1152-0-0x0000000000400000-0x00000000004092E7-memory.dmp

Download

memory/1152-9-0x0000000000400000-0x00000000004092E7-memory.dmp