72f6fb7308d30ad4738337597d2f87ddc2433ed314d3d30adf626251ba10ce01

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d6afefc369b2a9b4988df77461f6969_JaffaCakes118.exe
Size

233KB
MD5

2d6afefc369b2a9b4988df77461f6969
SHA1

3c172e5edb908f3b8af0f6b36b737bb1075a42d5
SHA256

72f6fb7308d30ad4738337597d2f87ddc2433ed314d3d30adf626251ba10ce01
SHA512

c5a8bd6ebdde6381f42b0b30e6bcb32faba191aae45bb2e9bccc22628ad7d7fa46895a5313fb4a2351b7a67a483f5f048c9d06849a464066c369010e40dc59bc
SSDEEP

6144:EP5f5UugaT3E2tVgNT5zs9XCC5NF6cv8no4:4xUu3E2trJH5z/8no4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000\Control Panel\International\Geo\Nation	2d6afefc369b2a9b4988df77461f6969_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4252	finder.exe
4220	scan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	4252	WerFault.exe	84

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4252	1788	2d6afefc369b2a9b4988df77461f6969_JaffaCakes118.exe	84
PID 1788 wrote to memory of 4252	1788	2d6afefc369b2a9b4988df77461f6969_JaffaCakes118.exe	84
PID 1788 wrote to memory of 4252	1788	2d6afefc369b2a9b4988df77461f6969_JaffaCakes118.exe	84
PID 1788 wrote to memory of 4220	1788	2d6afefc369b2a9b4988df77461f6969_JaffaCakes118.exe	86
PID 1788 wrote to memory of 4220	1788	2d6afefc369b2a9b4988df77461f6969_JaffaCakes118.exe	86
PID 1788 wrote to memory of 4220	1788	2d6afefc369b2a9b4988df77461f6969_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\2d6afefc369b2a9b4988df77461f6969_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d6afefc369b2a9b4988df77461f6969_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\finder.exe
  "C:\Users\Admin\AppData\Local\Temp\finder.exe"
  2⤵
  - Executes dropped EXE
  PID:4252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 252
    3⤵
    - Program crash
    PID:1700
- C:\Users\Admin\AppData\Local\Temp\scan.exe
  "C:\Users\Admin\AppData\Local\Temp\scan.exe"
  2⤵
  - Executes dropped EXE
  PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4252 -ip 4252
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\finder.exe

Filesize
27KB

MD5
565dea79362d55d53d8441320d450093

SHA1
a7db40d919ad1c879c2fabbfa92618ffeab6284f

SHA256
2639092a98104bc3b158323dc155570629a92e89470b12a4b84cb21b6425383d

SHA512
cdb30fa98c9f33dd04d9dccf0de537051039da241661c156cc97c080cc6797b832045b234a92447e595d1443c7c6a3c79c20b8be4f19b4948d88886dd7e5676f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scan.exe

Filesize
191KB

MD5
07b1a1f3c0f9c7e1009f94835b5c8d59

SHA1
e35475a3ef91de8d32b1c4ed6d2c96af272610ff

SHA256
c05e8669010a1d7b677d48fb974472d2d355c3f208d068f6b0f93b82f1403a32

SHA512
8350ce963a7f4e63ef57a21422cb439a470797b52d882a132404ea5cc7e7c48bd93eb61e44dce31660f076096d2fea38ccf0a94952f7946edcd4edab2bb4d452

Download Submit
memory/1788-17-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4252-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4252-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download