1cd2dce18028036d0f435bd254e34935fad7d807ae8f1c839e0ee02e39f01e9c

Analysis

max time kernel
140s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe
Size

106KB
MD5

1a2da68f22ea53f8ef8584dbe1ee2274
SHA1

2b2e07e005541630233765ecb859cccbdbd56ee5
SHA256

1cd2dce18028036d0f435bd254e34935fad7d807ae8f1c839e0ee02e39f01e9c
SHA512

279739923da3737e52409accf8d1ec0c77dd04f22024e5085df21862b48cd43d58d04245b0478656a741beb6263b4124a5325c9b544762b1164e59783522c656
SSDEEP

3072:SdYmD7K3AC7+n+xGPdFOV8LNXZbjZCALGTGqu:spC7++J8LNNZnLV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1804	tt.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\tt.exe	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	1804	WerFault.exe	82

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1404	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1804	1404	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe	82
PID 1404 wrote to memory of 1804	1404	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe	82
PID 1404 wrote to memory of 1804	1404	1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a2da68f22ea53f8ef8584dbe1ee2274_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\tt.exe
  "C:\Windows\tt.exe"
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 224
    3⤵
    - Program crash
    PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1804 -ip 1804
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tt.exe

Filesize
100KB

MD5
f418e918a9df814aa25a5245b90562bb

SHA1
fe54478fad07126a1d3c0b5c19f7cfe277fa83c9

SHA256
33c2db389a4330f5f811061a19b7d4f6f0a3afdbca9da111379cb50220883511

SHA512
a7a673769e45b8fab6e04f97ef41462172ce241a507c722108ffe45676448989cba4a65382f5272132e942695ba8745bca024b7d72e1d28385eb04dcfc6f3d8c

Download Submit
memory/1404-0-0x0000000000400000-0x000000000041C200-memory.dmp

Filesize
112KB

Download
memory/1404-10-0x0000000000400000-0x000000000041C200-memory.dmp

Filesize
112KB

Download
memory/1804-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download