0a40d5bc35bc6097183a6caf5b94785fcfe13ce006494378cc6f5bd700f601cd

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe
Size

123KB
MD5

2b7d451e6f39914b568a4f2eb5aa3fa3
SHA1

c30b8027d75e45356278f1445c09762331f72fda
SHA256

0a40d5bc35bc6097183a6caf5b94785fcfe13ce006494378cc6f5bd700f601cd
SHA512

a931a2e85eef92f0b7b0fcb57a8d6e4578cad0e2dd3695c46b3400ff6988eb7236ef04bd07b1affcc35742708af6ed378dadb71538e0fcdb6beb4cbcdede5fbc
SSDEEP

1536:KUA8SRNj73r3g6odqJhXVMlN9NRqdfngYCMeURsoqejzwFUr2/jgVMvM+gaOdg0w:SaKcqhSq0+rmsVz+nOufIndtLzy5qT+

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 3204	4636	2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe	92
PID 4636 wrote to memory of 3204	4636	2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe	92
PID 4636 wrote to memory of 3204	4636	2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b7d451e6f39914b568a4f2eb5aa3fa3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Dxp..bat" > nul 2> nul
  2⤵
  PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3848,i,5019894817651309870,579021928995875068,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:8
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dxp..bat

Filesize
238B

MD5
c36143928aea7c040c9c200aeb12e2cc

SHA1
6de5b73f752fc80edfe70d0da52f99dbd565e789

SHA256
dc077e3d21e7f482841d67ef120d3902529f7b65fdc2e4ba2a10597cfb6e0642

SHA512
055c13e1d692bc6623f76f688709efbe2485a856e95b3e1ef11b3d0b48cbf57451b99c2bd795e5eaef2fdd9eb4f28b2e1749291be867e7380d6a80aff1ba2091

Download Submit
memory/4636-0-0x0000000000409000-0x000000000040B000-memory.dmp

Filesize
8KB

Download
memory/4636-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4636-2-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4636-3-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4636-5-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download