cf9d43179f61d809d388bd5ca4f17df77592c1a2da7d3b3c0d4e5ca6d111fa20

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08da12f7e00e058fd51bb9989d3db0b9_JaffaCakes118.exe
Size

30KB
MD5

08da12f7e00e058fd51bb9989d3db0b9
SHA1

e5859919ddabbf6be8f0ed8d8e58125c39f07e66
SHA256

cf9d43179f61d809d388bd5ca4f17df77592c1a2da7d3b3c0d4e5ca6d111fa20
SHA512

026e3c218a2d7ac6e6bd44f33a0bbd0bc9bb0926443f069fd76e5ddd4e821fe7c4eb4f29ce20197573d789599f6d61a6f76cf55b4c08b4ed2d59eb4a67c14260
SSDEEP

384:TpXq+4wNV3BHXo0L7myQOQmc8n+N5ADt/+qVYDH4UsYwnM5qYo:9X4Q3BH40MO7+0DtmYiYbt

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	08da12f7e00e058fd51bb9989d3db0b9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4652	decrypted.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3492	08da12f7e00e058fd51bb9989d3db0b9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 4652	3492	08da12f7e00e058fd51bb9989d3db0b9_JaffaCakes118.exe	81
PID 3492 wrote to memory of 4652	3492	08da12f7e00e058fd51bb9989d3db0b9_JaffaCakes118.exe	81
PID 3492 wrote to memory of 4652	3492	08da12f7e00e058fd51bb9989d3db0b9_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\08da12f7e00e058fd51bb9989d3db0b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08da12f7e00e058fd51bb9989d3db0b9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492
- C:\decrypted.exe
  "C:\decrypted.exe"
  2⤵
  - Executes dropped EXE
  PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\decrypted.exe

Filesize
2KB

MD5
0c8663a15eb82d2547d52f5f68776b6e

SHA1
91d332cb5f10883e6ea674a2204e58441fb72b78

SHA256
1f690f68c6726975d2ed74875a6f66f72313b08ad5a88ed21d12ef05f18e1f23

SHA512
b383278e175fab03cfbf473ad09ab3f60fa8056c3b1fc384cb40c6410d169746722acfa58aa21cada2098fdccb35887cce7581624dd2d401b33964345f92249d

Download Submit