d0fcb3ab037ccd53bbbb3f5370db222c23f894e174fb7142bd6951edec7108f8

Analysis

max time kernel
141s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03ba5bfd3b6e220e826a3734d86d496c_JaffaCakes118.exe
Size

208KB
MD5

03ba5bfd3b6e220e826a3734d86d496c
SHA1

8e40f2c6fb10f9a5b4df2ab01d87317cfd5047e1
SHA256

d0fcb3ab037ccd53bbbb3f5370db222c23f894e174fb7142bd6951edec7108f8
SHA512

ea8a2850be048365a1ea47c448406f60fe570b395e4186dfbb0e08ff7d1c2d58c111744d3a143b58ca7281562e22aadc0a4e8170a58d87ad18cbdbc80c37a543
SSDEEP

6144:FqjHjqCVXidWqaYHbLM+o4DG0u4t8n9ib:FCuiiiYS4id5na

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	03ba5bfd3b6e220e826a3734d86d496c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2408	hg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\hg.exe	03ba5bfd3b6e220e826a3734d86d496c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3608	2408	WerFault.exe	94

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
376	03ba5bfd3b6e220e826a3734d86d496c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 2408	376	03ba5bfd3b6e220e826a3734d86d496c_JaffaCakes118.exe	94
PID 376 wrote to memory of 2408	376	03ba5bfd3b6e220e826a3734d86d496c_JaffaCakes118.exe	94
PID 376 wrote to memory of 2408	376	03ba5bfd3b6e220e826a3734d86d496c_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\03ba5bfd3b6e220e826a3734d86d496c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03ba5bfd3b6e220e826a3734d86d496c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\hg.exe
  "C:\Windows\hg.exe"
  2⤵
  - Executes dropped EXE
  PID:2408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 224
    3⤵
    - Program crash
    PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2408 -ip 2408
1⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4136,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\hg.exe

Filesize
189KB

MD5
07ac2400bd9b2fd73da74dff8c048885

SHA1
0c96706a54d6547ec93662071a4cc7e0720fb754

SHA256
d265e68a60c56d3e7c23db30cddba529a9c83109ba1fc220add119e9d205c81e

SHA512
ed511a084dffb3d1909a3795f1dabeb39f908195308297f65e5102caa7420e83ff6fa268bb2677e95e7cdbbb0e46932dcb0e8d3f936a2caf065c7fe8e7105cd3

Download Submit
memory/376-0-0x0000000000400000-0x0000000000437200-memory.dmp

Filesize
220KB

Download
memory/376-12-0x0000000000400000-0x0000000000437200-memory.dmp

Filesize
220KB

Download
memory/2408-9-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2408-11-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download