73ad76933a6f55a53dcbaecbace8457f0dd095ce78f75e4fa70b161664a9aaa5

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe
Size

567KB
MD5

2ac90ccead8da159233fe4096f5ff0c8
SHA1

c5ecff37dc5dec066e6969d905204c60144e4b2a
SHA256

73ad76933a6f55a53dcbaecbace8457f0dd095ce78f75e4fa70b161664a9aaa5
SHA512

a3f148613241fd93616fd012ff2148a86fdbb4f9483da77905997292609429323d00714ffc84f475a8e8cb7b47ed4224f162030a08eca6a2bc109a087cd22eff
SSDEEP

12288:NJYIlIUr41owTtmHgYPW82ImgHTas8NrWr4YYARWP/yYaI1xCLo6yvw:NZlaTtmHJPWBImCTar84XH7x1s8Zo

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation	2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3260	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3260	4892	2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3260	4892	2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe	85
PID 4892 wrote to memory of 3260	4892	2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ac90ccead8da159233fe4096f5ff0c8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"
  2⤵
  - Executes dropped EXE
  PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\banner.gif

Filesize
50KB

MD5
2bbfe6a0dfc9b9038b82d7183bf9c79b

SHA1
2a167441b84ab72dfc68696b0cfe5cc0209d3553

SHA256
a090f0a02ee737a47f5bcc7c8a7e30b0328f6448d05ae57101563a29693fdb28

SHA512
30c204243a5b8db8ecb6c8bdd32508129ed161ae0c515e677712845ea709d0f78f5093309f830eff5eaf7287fa9220565005e02e7fe7aa507241ac53f2ef9fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\grey_bar_710.gif

Filesize
1KB

MD5
8f37f672ca6923a9cc3b2d0f7007f6dd

SHA1
4be4c36139fbebdb0d5dc0593414aef850251a11

SHA256
93b5d88603d4aae07ea4d135b0b2de3efee8137221c8bcb64a28bee8e300dac7

SHA512
858f31a6be34f7f7ea849c5a805fb9b0f23cb5bdc2e710ed0bc72dfbe2ecd539ed21c3603038dd969232d4ce97e23f21855ab81a3cfac8a5d3640253811aabd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lang.ini

Filesize
2KB

MD5
119b482883e355b1489628f33ee9ef88

SHA1
aff3ddbd68ff41d116af1b64558b354b8d1c3dca

SHA256
83cea594ac7bb6b1fc78bfce814b129189309882ff0fe760ca6bba103292d299

SHA512
c4eaed2b17d69189c9514646fdfeed4d4e8190f992f1c13375224fc00ac2a99b7850de6eaf0f2b3ebb35b251f74b6d859b1052a06b5900d0fbef25c84f6c0a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe

Filesize
835KB

MD5
36a25ebfbeefe809b692a48853ad0721

SHA1
1baf55b5a63d68be8b84c0f36555fd6207ee41dd

SHA256
85fdb70a131d0cc7fa4b5d713dd72c39802bdd0cf0b7bb6f2d574097a5bd3ac3

SHA512
574d992e87ff5deff615ca56e8ef63616d6d44cf121e68dd72e2ee7823e1a31f9a882261068aab1c7fcdf2f1dd6cc7aa653f7c6f9096893dbf43b41555c5c1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.ini

Filesize
6KB

MD5
a7bea13818443198e2469591f774d235

SHA1
94ea8ffcfaca9abab13d00d1df0a73efa32b3edf

SHA256
e394da7750f17ff4bb99a8189de78860b4e2ed95d5be653348c3c24ac347a0ee

SHA512
9fabf260a169dabbb37ca922fcf447a0b6b2241e54b52b44db34b6b91153a61273471c3be1ed7d77baa2258fb5f2f790b234819f600a585e41df4b0f0a0971ea

Download Submit