1d4cdfd45bc16e428ab9b3d1a84bb03535b4944d86b6b8f7955ed0e5a28338ee

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2edac356071486500a99e798352bd73e_JaffaCakes118.exe
Size

128KB
MD5

2edac356071486500a99e798352bd73e
SHA1

b17efddf2fae25ba1b34af851812971b8b851b20
SHA256

1d4cdfd45bc16e428ab9b3d1a84bb03535b4944d86b6b8f7955ed0e5a28338ee
SHA512

c0e97bd69cbec253c584f3ca5b7e939f0eec7d8cfb7d1acef351b8576642b3f0015a430993b94713d678a0b86e8f00f19bac19c4a5584ba9486ced6cf81c523d
SSDEEP

1536:dKDqJvz2xyM40DSmJRsafuzE9y+3YkUnDHG1oL1nmz8AMszbmrQvLnpB6ENomyS8:dKDAfCDSmJRjj9tU+oJnmoiurGjp1yS8

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3310979990-555183016-1244931625-1000\Control Panel\International\Geo\Nation	2edac356071486500a99e798352bd73e_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
1060	Nazi Zombies Mod Tools.exe
4516	readme.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4516	readme.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1060	3308	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	84
PID 3308 wrote to memory of 1060	3308	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	84
PID 3308 wrote to memory of 4516	3308	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	85
PID 3308 wrote to memory of 4516	3308	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	85
PID 3308 wrote to memory of 4516	3308	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2edac356071486500a99e798352bd73e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2edac356071486500a99e798352bd73e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\Nazi Zombies Mod Tools.exe
  "C:\Users\Admin\AppData\Local\Temp\Nazi Zombies Mod Tools.exe"
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Users\Admin\AppData\Local\Temp\readme.exe
  "C:\Users\Admin\AppData\Local\Temp\readme.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Nazi Zombies Mod Tools.exe

Filesize
137KB

MD5
c26c8edeb6ecab667cda7d1eaae49f96

SHA1
9a94cf2a55299588bed0ce86ed07e03667854725

SHA256
e5af49db365c9ced2e1b056a198c1f0343279856658b7012a5762b08c0a7edda

SHA512
e83455940afd00e71da05a0e2a687be9838f4896a948e301544436d2f2e70e4087cdea069dc7f4d89584fa5b28db4b61a8668f7576f7cd99b6db83e1c10084cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme.exe

Filesize
32KB

MD5
b15242452d12380433837e65de2c6b5c

SHA1
50f18de163f36e9327a8880fd4685e845f8ac2e4

SHA256
e3cb4d12e6fa9490b61fe1ac1a6950238eaa0681db938c5ff51097405ef6d566

SHA512
45a391636a67ba251064a14637ab542bf84692c528cf925999b3a698a25e27521ea4014538deeac1089c322d58af49d332a1948d7e85227853b5b2408774019b

Download Submit
memory/1060-24-0x00007FFDF9F95000-0x00007FFDF9F96000-memory.dmp

Filesize
4KB

Download
memory/1060-25-0x000000001BB20000-0x000000001BBC6000-memory.dmp

Filesize
664KB

Download
memory/1060-26-0x00007FFDF9CE0000-0x00007FFDFA681000-memory.dmp

Filesize
9.6MB

Download
memory/1060-28-0x00007FFDF9CE0000-0x00007FFDFA681000-memory.dmp

Filesize
9.6MB

Download
memory/1060-27-0x000000001C0E0000-0x000000001C5AE000-memory.dmp

Filesize
4.8MB

Download
memory/1060-29-0x000000001C710000-0x000000001C7AC000-memory.dmp

Filesize
624KB

Download
memory/1060-30-0x000000001BC00000-0x000000001BC08000-memory.dmp

Filesize
32KB

Download
memory/1060-31-0x000000001C870000-0x000000001C8BC000-memory.dmp

Filesize
304KB

Download
memory/1060-32-0x00007FFDF9CE0000-0x00007FFDFA681000-memory.dmp

Filesize
9.6MB

Download
memory/1060-33-0x00007FFDF9CE0000-0x00007FFDFA681000-memory.dmp

Filesize
9.6MB

Download
memory/1060-34-0x00007FFDF9CE0000-0x00007FFDFA681000-memory.dmp

Filesize
9.6MB

Download
memory/1060-35-0x00007FFDF9F95000-0x00007FFDF9F96000-memory.dmp

Filesize
4KB

Download