f3c4c2827e9cc81c27c9b261533cdc826a3b9724344ddc92394e073c66338170

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe
Size

21KB
MD5

05f46af58c8234972d509542f3aacf0c
SHA1

062fa4b59d00a55727a12a8d511440af6a18c898
SHA256

f3c4c2827e9cc81c27c9b261533cdc826a3b9724344ddc92394e073c66338170
SHA512

33c7549310f70e7ea82656695350c50838931e584fdb3b0b1cd907522cc5d1fd235a91fc03151388c0ac3dce69fb177f66470b48a64330a87700487b7b5b4561
SSDEEP

384:GGlv4kgEaorkmjSVQK/KUCcRCe5VDynWK8eOlnEuTTtWOeo:c2aor5jS3KUCcge5VD8D8blnEe

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl\CLSID	05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl	05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"	05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1672	05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2652	1672	05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe	96
PID 1672 wrote to memory of 2652	1672	05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe	96
PID 1672 wrote to memory of 2652	1672	05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05f46af58c8234972d509542f3aacf0c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\awer0.bat" "
  2⤵
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\awer0.bat

Filesize
302B

MD5
f8b88bc56da88ba6cf1ed84d4815d8dc

SHA1
a75d536480218c0232e60b17c4e39a5fb2743c26

SHA256
9d1ff3c0f919bc5ee498274ac981713164dffd009a1d97e3b70d3b2ab14e612d

SHA512
f613d3e109a8636831e64b59ad4be5382b29d4710fe4bae9f3c1464b18a168739b754c9b20a490201e4331c6d47c912c8f41c5771486bf1137be722d6cecc4de

Download Submit