fd62ff31008deeedab0ea73219d46c995bcb10916d92b1cbb230a4987465308b

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29f544fb8daf05ed88322cca9cc1da44_JaffaCakes118.exe
Size 8KB
Sample240707-nzh6dateqc
SHA256 fd62ff31008deeedab0ea73219d46c995bcb10916d92b1cbb230a4987465308b
MD5 29f544fb8daf05ed88322cca9cc1da44
SHA1 2504abff4328ef85e1380cde8c28d82bbbb36c10
SHA512 b0ff847e6e62f27c3761ec5a1a8f4b2eefd3bfbee80921cf4cb99b5771807708565cf3d9cae507e38c33b18b55ace0eee5beb291424fb83f0dcfe27d5d2ebb5f
SSDEEP 192:DU8BxgclYO0i+8DwRcM/NOyFaNJhLkwcud2DH9VwGfctlXO:DFBFlR0i+8DE3w2aNJawcudoD7Uy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000\Control Panel\International\Geo\Nation	29f544fb8daf05ed88322cca9cc1da44_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 1 IoCs

pid	Process
2908	b2e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4248-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4248-10-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 2908	4248	29f544fb8daf05ed88322cca9cc1da44_JaffaCakes118.exe	85
PID 4248 wrote to memory of 2908	4248	29f544fb8daf05ed88322cca9cc1da44_JaffaCakes118.exe	85
PID 4248 wrote to memory of 2908	4248	29f544fb8daf05ed88322cca9cc1da44_JaffaCakes118.exe	85
PID 2908 wrote to memory of 3112	2908	b2e.exe	86
PID 2908 wrote to memory of 3112	2908	b2e.exe	86
PID 2908 wrote to memory of 3112	2908	b2e.exe	86

C:\Users\Admin\AppData\Local\Temp\29f544fb8daf05ed88322cca9cc1da44_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29f544fb8daf05ed88322cca9cc1da44_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\D39C.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\D39C.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\D39C.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\29f544fb8daf05ed88322cca9cc1da44_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D5DE.tmp\batchfile.bat" "
    3⤵
    PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\D39C.tmp\b2e.exe
Size 8KB
SHA256 7d7678849164216dd02054f69a184530cd83c2f778123ca3ca72ea3a119002ed
MD5 d53ce9f668917a13cda2430c3724388d
SHA1 15459fa33c475192a9f83403398e0fc5d9d3f2e6
SHA512 e30ba9418659fc33ef7cb9def6ad0fc2015ce7553a468c266de4f6b840f67db273abfeddcf450cb5f42c5cd9cf7da15bd62f2a5439326cdae1e58596ede6cbd7
SSDEEP 96:3jrxEyFlnpkGd3aabLXKWxM/paKEiYzusDuAkPLiUmeFKOeO9XWLOb2D0gcDv:3R5Fhp8cdwpHR3AkPLiM79mLU2PcDv
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\D5DE.tmp\batchfile.bat
Size 43B
SHA256 f07a35461620d27ac25b917e94277a4f0163d36f3d3796b24d8fc5b00e2a11d4
MD5 ee21b85219e83e68af49c544adab3365
SHA1 84c46cfc1a4609be5d828156bf4fe67baf6a1143
SHA512 ce76d6be18eddeb2d12c9376fe15b6aa92ae26c09679170e8e326bf58aee32325a230ac43ccc910348837b0a75e9c16f7081dc7ba77a22fd94d58660333d5876
MD5 SHA1 SHA512

Submit Download

memory/2908-12-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4248-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4248-10-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads