ccadec71d575eef856d53520d062d1b60ec152518a70ae3ed4f0fd4d54e8f97a

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3075331ad30fa9ebeb21f950dc4032ce_JaffaCakes118.exe
Size

94KB
MD5

3075331ad30fa9ebeb21f950dc4032ce
SHA1

9a22846511edabf0cf9182bfe3cf6f0a42e8fccc
SHA256

ccadec71d575eef856d53520d062d1b60ec152518a70ae3ed4f0fd4d54e8f97a
SHA512

8e7fb7825a1bd9e2e13612e19c7bacb1575a1fd816ed055cd18b080d9632dd6708f2c9770539626e3f8248fdbc3d40ae8825bfd3cc8de0cdaba82486cfd2de4d
SSDEEP

1536:wbO889LGH7zi16xGTtnY1iHxwdyPGLOlGSOB73Uq7PcQPKrJq+XhL:wa88dGHyYDUGrSm7H71PKlV9

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation	3075331ad30fa9ebeb21f950dc4032ce_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 2244	608	3075331ad30fa9ebeb21f950dc4032ce_JaffaCakes118.exe	85
PID 608 wrote to memory of 2244	608	3075331ad30fa9ebeb21f950dc4032ce_JaffaCakes118.exe	85
PID 608 wrote to memory of 2244	608	3075331ad30fa9ebeb21f950dc4032ce_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\3075331ad30fa9ebeb21f950dc4032ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3075331ad30fa9ebeb21f950dc4032ce_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Mhf..bat" > nul 2> nul
  2⤵
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mhf..bat

Filesize
238B

MD5
2c5f0f2cbe041f5f1fdfc3847d905cfc

SHA1
2e85f597aff0da4e57545fd4b5cfb89b68a248ab

SHA256
80082f051a6a8eedf8576dc2f8966113ba5ea64690a9d4bee15c5884ebae6f00

SHA512
cff3f776b79b4a4c9b95cc847f12461e2c9338a93447d9f675e4c0094e0c4edd9ac7e356b92d628ebe10dc96d59174bcebcd92a4ce91338eed8d5f2b97160c62

Download Submit
memory/608-0-0x0000000000402000-0x0000000000404000-memory.dmp

Filesize
8KB

Download
memory/608-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/608-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/608-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/608-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download