1620b51d748b21215667eea4450415c2e95af89b0f48b3fa8b4fd3fc9a3d815f

Analysis

max time kernel
141s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ddd171394c979f06b32956836c7b17b_JaffaCakes118.exe
Size 227KB
Sample240611-mg45fstgln
SHA256 1620b51d748b21215667eea4450415c2e95af89b0f48b3fa8b4fd3fc9a3d815f
MD5 9ddd171394c979f06b32956836c7b17b
SHA1 aabac51b5adf74be99a9b8d0dbbe172a4e6c377e
SHA512 5b63846531668f753020f2bcefcc9b7d87a0cafce982c1d77bfa209ec0b12db5ea287abb2c5f7d4ab8be71d6e71f9c9e7e040d0c42f5009ec675985471c056d3
SSDEEP 6144:0p4wdZ3t4A6M2kwp+E4tEZw7BkJgSoS3V//:0p4wj3t9B7wp+1+w7NSoS3l
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	9ddd171394c979f06b32956836c7b17b_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3128-0-0x0000000000490000-0x000000000052E000-memory.dmp	upx
behavioral2/memory/4552-45-0x0000000000490000-0x000000000052E000-memory.dmp	upx
behavioral2/memory/3128-164-0x0000000000490000-0x000000000052E000-memory.dmp	upx
behavioral2/memory/4552-189-0x0000000000490000-0x000000000052E000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\PROGRA~2\Zona\License_uk.rtf	9DDD17~1.EXE
File created	C:\PROGRA~2\Zona\License_en.rtf	9DDD17~1.EXE
File created	C:\PROGRA~2\Zona\utils.jar	9DDD17~1.EXE
File created	C:\PROGRA~2\Zona\License_ru.rtf	9DDD17~1.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 3540	3128	9ddd171394c979f06b32956836c7b17b_JaffaCakes118.exe	80
PID 3128 wrote to memory of 3540	3128	9ddd171394c979f06b32956836c7b17b_JaffaCakes118.exe	80
PID 3128 wrote to memory of 3540	3128	9ddd171394c979f06b32956836c7b17b_JaffaCakes118.exe	80
PID 3128 wrote to memory of 4552	3128	9ddd171394c979f06b32956836c7b17b_JaffaCakes118.exe	83
PID 3128 wrote to memory of 4552	3128	9ddd171394c979f06b32956836c7b17b_JaffaCakes118.exe	83
PID 3128 wrote to memory of 4552	3128	9ddd171394c979f06b32956836c7b17b_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\9ddd171394c979f06b32956836c7b17b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9ddd171394c979f06b32956836c7b17b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\SysWOW64\cscript.exe
  cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs
  2⤵
  PID:3540
- C:\Users\Admin\AppData\Local\Temp\9DDD17~1.EXE
  "C:\Users\Admin\AppData\Local\Temp\9DDD17~1.EXE" /asService /logPath "C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log"
  2⤵
  - Drops file in Program Files directory
  PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 8KB
SHA256 18127584c7ccb9b471d25885089d11cc2a7b3678d61e1106b54018699f5aff0c
MD5 390b4130576e84ff26955c67369de132
SHA1 4015857c08a6b1ccdfa61fb43c219d49049b0179
SHA512 422a0f6fa7a40ec7c79a41e2a6507d6e17bee21daac215df6671159a106f2f94df3339b75b1cd5910dae733404c409a47e0edc39290280663dd8823316a57db5
SSDEEP 192:OoehAmoktI2snw8kkRxg0uwgqB/XKrvMN27521cA0ej5vF:O1htoku2snwNksYKsl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 8KB
SHA256 be366d38cb9cf1c190a20982442cef56e5bbb9fd3568eeabc5da94322b446f63
MD5 b7ef2dae37a1a692a4eecb8335c8d8ba
SHA1 e2dd6f1a85a7a27a89a17cd64ed380a67504d8c7
SHA512 e3eb12a088c6895386efb93b197eb826480acb4e53d02b2d4592dad92689959af98e6b8271418d3673cfba06a56234d8772e6868a67aa5c82337a1911230ea39
SSDEEP 192:OoehAmoktI2snw8kkRxg0uwgqB/XKrvMN27521cA0ej5v3XxYie:O1htoku2snwNksYKsnSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 9KB
SHA256 582d1c6728e827971543aaf445e8cf00b5c52fe47689872ab91360c665a58b90
MD5 6ca738400fb807e3042928b7990aa05a
SHA1 0d94984d9f2238ce83cde4fb59df42932ca15fe1
SHA512 b67e7471e1269fbb794489d8c010a11df284b30971cbe2c5eb27a720c75aeb9d5ad0a84fca5890cd63c3c1870c458f1fe60d40d7159cfd01fb0d5802431784cf
SSDEEP 192:OoehAmoktI2snw8kkRxg0uwgqB/XKrvMN27521cA0ej5v3XxYiGG:O1htoku2snwNksYKsnSa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 9KB
SHA256 7f79f1d8a977249eded6acaeb3b43f3a0983d9d8ff2d4a490ec6fdb30879ec46
MD5 e52c2fb962cb6e5713dfc22655f4137f
SHA1 eee811a1f99caa33a968f3eb2e60b1a1f0e5eff9
SHA512 afdc1c0fe5d602a24233163cdd6a41cddac7cafda2cc61a56613cc92ba40ca4ea25b9f4b90dfc01758e035f7db913a31b1494dc48e23c7607e8359579bea4f79
SSDEEP 192:OoehAmoktI2snw8kkRxg0uwgqB/XKrvMN27521cA0ej5v3XxYiGl:O1htoku2snwNksYKsnSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 9KB
SHA256 718abff884864d5e818a341ca16d90009798c559734ece6e33dec2018fe60264
MD5 ce2fca83d7496b505b23f8c986209996
SHA1 9f33e6d0c1f96c7475325b8d21216eddecc3e2e2
SHA512 56af6de7eebfa9e26b01adbb42e5e8108326d9e2f2239fd31c476aff1708c80155112927a3a3df798303ef56ec17efcdb55834f480661d17b7018ae7a7fe74e7
SSDEEP 192:OoehAmoktI2snw8kkRxg0uwgqB/XKrvMN27521cA0ej5v3XxYiGZ:O1htoku2snwNksYKsnSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 11KB
SHA256 2c3649271f607563d2894f427e62a47410d5e5f2067015dd43e5995304725962
MD5 c44da1ab4ecfc7c306e091db13ad5d46
SHA1 569a79cda531e92656585b7fb98ca3889a28f390
SHA512 c9bb38c34443949fe7feb32a202e7296715a9c4e513e9918b332f549890aac4b80d33f8ddb00ea831718acef18fc3c523fc934d42501ce9d28b0fd99b33f5d99
SSDEEP 192:OoehAmoktI2snw8kkRxg0uwgqB/XKrvMN27521cA0ej5v3XxYiGjX7xX30g:O1htoku2snwNksYKsnSXZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 12KB
SHA256 b942dbe87f875b29c2451ff7896129d7a48c581c0fe41132749ff6b77b0453a6
MD5 813728808e809c62bd32fb26acd57c0a
SHA1 5aa0729f3c46f52a8ff1d14e9e715e4fa5e5bb68
SHA512 f6a5bfdf1a5e69d795000dc588e0634a0c0bff13eddeb512ffe46b8d4c7206ed2af825e59658a9cbb35178ff273f0de48e50ff33c9d9624c52f9ff2d6f811d3d
SSDEEP 192:OoehAmoktI2snw8kkRxg0uwgqB/XKrvMN27521cA0ej5v3XxYiGjX7xX30Z9kM9:O1htoku2snwNksYKsnSXZ4kM9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 13KB
SHA256 416e5806e705b4dabb3371d4b1cc82430c3bfb92df9851d775c16752dfebd9c2
MD5 8f96a213f2cb7798dc1a9c2d1403c677
SHA1 112844045665be6ce37978f711c85e1ae51359d2
SHA512 bc323a8ae310fbaf5ba35e25d9b5493808ebb8f3b5b1449ff5da5d929188000ebd20558057ca31e114a646d189ce58b3c6d2251dca6eddb684ac6b6530a4804b
SSDEEP 192:OoehAmoktI2snw8kkRxg0uwgqB/XKrvMN27521cA0ej5v3XxYiGjX7xX30Z9kMF0:O1htoku2snwNksYKsnSXZ4kMxk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 4KB
SHA256 9378327d0fb2a9c898b6f61c8bc78cdbed626a96839e05da450ddb4d566eb903
MD5 f40f02443819b58e90ee50922619dd8f
SHA1 02ce2f78083c0763c96336f53583d60cb5d7e9f6
SHA512 d744c596293f9e1bbdc7dcf76e9a3e4a774c1b7f45b59433986cc0a088c29076ad8a7e9d25c23330944c89c92671638e49440891dd16c746d6b098c279b5b554
SSDEEP 96:oWAWsIFVvcDUdmS2hAmTvyNnkntfMh2X2dntC8HiZNnke:OoehAmoktI2snw8kke
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 5KB
SHA256 9b9d71c4035fdae2d747239686d85da9ada737a4b3672922c3475418a13c7316
MD5 45b73f14c637ef3acc4940bfdc4f1870
SHA1 f9ee49ed1317ebd067611cbd7d0ff0f9a168cf1d
SHA512 39ab4f3befe32821e438df6269f5c36bf33373b477550629d78dc70e735c7a61d3c6f6a1c75fd4d5c349f1615c7320d5b56411c41036d694dc548da45903ddb8
SSDEEP 96:oWAWsIFVvcDUdmS2hAmTvyNnkntfMh2X2dntC8HiZNnkRhvHk30:OoehAmoktI2snw8kkRxd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 5KB
SHA256 076d8a062284e850f4b5f76654ee389dcbdb9ef07f702e82d39ad63f4b1b3f27
MD5 3cc058ba0fda0b05c629434b9d3cb02a
SHA1 359eba9732cd9aaf1ee67fdb31f3c934b8e35335
SHA512 e86b24aaea75a706db41b7eee834fec3f4b7cb5ae4734edde5f9431f0ce996c73c692102f12154d85c9c4e58865805b622004cccb1f036191e4d1e95fe06083d
SSDEEP 96:oWAWsIFVvcDUdmS2hAmTvyNnkntfMh2X2dntC8HiZNnkRhvHk33QcK:OoehAmoktI2snw8kkRxga
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 7KB
SHA256 1b750d6e63c1d5b82b1b60cdc40da7818426835db09ff71851c5cba35ad797c5
MD5 a3a4d04e4fe8fab3559d2d10af68957a
SHA1 3d09b367d4b2ee99cbcb33a0cb1ae942d20bea92
SHA512 2802980cd65382a58b7a0f25b3160a3e14fd5b119e6bc866fee05f4f13c33c4aa8845a7e3235e71ac504fac2bb8ec6bfaad84b25cad7c5dc5f9101618aeb3f69
SSDEEP 192:OoehAmoktI2snw8kkRxg0uwgqB/XKrvMN27521R:O1htoku2snwNksYKw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 2KB
SHA256 e5ed07a2469f65c40001d6df7796cf644fffe8481522208c931ba4df6a204f1f
MD5 e9f83fdcaa1c31067dc69a335e8f4d94
SHA1 8f98675d93b4fa77c15eb822997ab7f2293fc35b
SHA512 6c7835ed59f1eebca18f5d25c06b1227e13ecc646ea242eed0a81849e69706732232372415f4623c244e0cb3b8948ede0bddce43d60674157e097363d166c8eb
MD5 SHA1 SHA512

Submit Download

ZonaInstall.log

Path C:\Users\Admin\AppData\Local\Temp\ZonaInstall.log
Size 7KB
SHA256 c8db63d58a50fdc495982f3847e24db36410f08642b70de8d468e48a1f4a9545
MD5 d985d377b9db7f5f06e1ad73e34603cb
SHA1 f84b44761b4481c630cdf9c46babd985b53bedef
SHA512 4fe19519df13a9443008108223048a0fedcfc8305f24123bb09a1347e1657722c819db0ed5eb89abf6b2135e49c203e895b00e940a4ddbac42e16926ba2653dd
SSDEEP 192:OoehAmoktI2snw8kkRxg0uwgqB/XKrvMN27521cA0ej5vY:O1htoku2snwNksYKs4
MD5 SHA1 SHA512 SSDEEP

Submit Download

hd.vbs

Path C:\Users\Admin\AppData\Local\Temp\hd.vbs
Size 245B
SHA256 4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
MD5 d8682d715a652f994dca50509fd09669
SHA1 bb03cf242964028b5d9183812ed8b04de9d55c6e
SHA512 eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca
MD5 SHA1 SHA512

Submit Download

133625752310505412javaSetup.exe

Path C:\Users\Admin\AppData\Roaming\Zona\tmp\133625752310505412javaSetup.exe
Size 153B
SHA256 29574dc19a017adc4a026deb6d9a90708110eafe9a6acdc6496317382f9a4dc7
MD5 a53e183b2c571a68b246ad570b76da19
SHA1 7eac95d26ba1e92a3b4d6fd47ee057f00274ac13
SHA512 1ca8f70acd82a194984a248a15541e0d2c75e052e00fc43c1c6b6682941dad6ce4b6c2cab4833e208e79f3546758c30857d1d4a3b05d8e571f0ce7a3a5b357be
MD5 SHA1 SHA512

Submit Download

memory/3128-164-0x0000000000490000-0x000000000052E000-memory.dmp

Download

memory/3128-0-0x0000000000490000-0x000000000052E000-memory.dmp

Download

memory/4552-45-0x0000000000490000-0x000000000052E000-memory.dmp

Download

memory/4552-189-0x0000000000490000-0x000000000052E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads