c76d117cfa6fef441af15b0c94249437358d1abaee325caa1dc2d0af9816b48d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b54e5c493b454b802bd6d3df61164dc_JaffaCakes118.exe
Size

187KB
MD5

0b54e5c493b454b802bd6d3df61164dc
SHA1

e10d5e5727228da987ca7a3b92c924f15176ed65
SHA256

c76d117cfa6fef441af15b0c94249437358d1abaee325caa1dc2d0af9816b48d
SHA512

28828f00bfd55eb033392dbffda57f2180911637168825ae202f0ab158a6698933d3bc4fea5dedd5f8ed46ac9c967d69c566b09231f7d91ab3e1e17ee6ab2e3c
SSDEEP

3072:zB2f+AUTpldpukuG41s51qSBt9Ci6/52QpSpzvjc4q5cgm3Dl6aSv/4:tA+AUTpldpbKSBt8l52Q49vj5q5xMUab

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	0b54e5c493b454b802bd6d3df61164dc_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4024	quip.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4024	4328	0b54e5c493b454b802bd6d3df61164dc_JaffaCakes118.exe	81
PID 4328 wrote to memory of 4024	4328	0b54e5c493b454b802bd6d3df61164dc_JaffaCakes118.exe	81
PID 4328 wrote to memory of 4024	4328	0b54e5c493b454b802bd6d3df61164dc_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\0b54e5c493b454b802bd6d3df61164dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b54e5c493b454b802bd6d3df61164dc_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Local\Temp\quip.exe
  "C:\Users\Admin\AppData\Local\Temp\quip.exe"
  2⤵
  - Executes dropped EXE
  PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\quip.exe

Filesize
187KB

MD5
55f6a9238feb0bd8c672a92d5f160150

SHA1
60e0e91350f78566fde8f422eef66589c7fda605

SHA256
9c547f5aafe794cad74b3a7d7eb7969b55dbf5c8b53aca043056c3f2776a6cef

SHA512
7d9c3727b26af0d9e37c004c05aa3e3e411ff4a36681a4e812249f8f679bd4763e3b17c5c44e2acd6a6f5f60b53ab915fe0909ef395689b4e5ea018ef74cc903

Download Submit