ebabb50cd9e806b5ee503aba81a3b7d89caf89aed686746183f42749b23fa424

Analysis

max time kernel
128s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2add55fbe84d87802c9da536a9ad9400_JaffaCakes118.exe
Size

116KB
MD5

2add55fbe84d87802c9da536a9ad9400
SHA1

d513f9dce33b517d39f2d545a1d795bfde5deae7
SHA256

ebabb50cd9e806b5ee503aba81a3b7d89caf89aed686746183f42749b23fa424
SHA512

d5e825f7226e67f940fbe11f65cee77d4c2032781d63d6f2155d5857bfebea9bae5fd505249f1a0150c9a00c98e89cf4bc8646c03a71ac062b1ddfd7defbc17c
SSDEEP

1536:e8MFN7qNlfNe+zLipk+JOmuvBGVa/TYareDRRdauTZ8yEnm+Ad4gricMsh:Cb7q71LzLikOupGVgeDsuTZAo4lsh

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	2add55fbe84d87802c9da536a9ad9400_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 3832	3296	2add55fbe84d87802c9da536a9ad9400_JaffaCakes118.exe	97
PID 3296 wrote to memory of 3832	3296	2add55fbe84d87802c9da536a9ad9400_JaffaCakes118.exe	97
PID 3296 wrote to memory of 3832	3296	2add55fbe84d87802c9da536a9ad9400_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\2add55fbe84d87802c9da536a9ad9400_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2add55fbe84d87802c9da536a9ad9400_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Mxp..bat" > nul 2> nul
  2⤵
  PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4220,i,13421008738336098502,1902686380018635081,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
1⤵
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mxp..bat

Filesize
238B

MD5
9090a07e296bd4f344ec7f8b8484c351

SHA1
3bdbc39784ff05dca07edd8056ee5a2ddd2cb65b

SHA256
6d2cad0fa350c156830af2f98fe1bd4cbef32dcd249e914712c8ec094fdcfb5e

SHA512
dda9c1fe0fe1bd6098b376af3fa1114cdb2ab2d681ace63321f53dcc276c57bbd9a7bcc7c81a9a7f71e95a5de90906fb01a719295d1a1ee32d74f99457de9e60

Download Submit
memory/3296-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3296-1-0x0000000002020000-0x000000000202C000-memory.dmp

Filesize
48KB

Download
memory/3296-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3296-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download