670f18d8f01fd808ff63c9bad2905e9afc797d32cea534af24464a699dff4dde

Analysis

max time kernel
79s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01461cd7946aa8d3e0c5f5df9246304b_JaffaCakes118.exe
Size

115KB
MD5

01461cd7946aa8d3e0c5f5df9246304b
SHA1

f4b50e5dc225e650c5970c22a14af60b8434231f
SHA256

670f18d8f01fd808ff63c9bad2905e9afc797d32cea534af24464a699dff4dde
SHA512

e9504ed2ea6ccfafbce75055cecdefc2b154751ed687d63bcfc255374a7baa4b692a13ca15e2cb111b2c3ae3081b8452d8aedce0a9f430b994b2ce02448c0ff0
SSDEEP

3072:rvkGO9TMGNG0WycxnvdwOxQZbGL6msFhx2Dm5A2:TkGmMGky+iO+GCh0D8z

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	01461cd7946aa8d3e0c5f5df9246304b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 1996	444	01461cd7946aa8d3e0c5f5df9246304b_JaffaCakes118.exe	85
PID 444 wrote to memory of 1996	444	01461cd7946aa8d3e0c5f5df9246304b_JaffaCakes118.exe	85
PID 444 wrote to memory of 1996	444	01461cd7946aa8d3e0c5f5df9246304b_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\01461cd7946aa8d3e0c5f5df9246304b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01461cd7946aa8d3e0c5f5df9246304b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Nxf..bat" > nul 2> nul
  2⤵
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Nxf..bat

Filesize
238B

MD5
32f445cd6a0b21b8b3e18ed1d628ab03

SHA1
e343c6b5f630f8c495297e2def6df5de4d131ebe

SHA256
c8d300a113a3dd90271cf01299c6a861b767ff973cedd813101575713ca261bf

SHA512
4414295c0b86b2f72d8263cff146c0fba4be51c94f151a36626e6dc282f28310a95c58bda80575de542b7f0b75658ae7a4187756f8ebf8a4216a417430941ef0

Download Submit
memory/444-0-0x0000000007D20000-0x0000000007D30000-memory.dmp

Filesize
64KB

Download
memory/444-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/444-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/444-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/444-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download