8173577d9d5435172b823238eb6994e6e96b57f0b8403126195d89f873db8aa1

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31302936995b78f1bc5167aa1ce51f53_JaffaCakes118.exe
Size

798KB
MD5

31302936995b78f1bc5167aa1ce51f53
SHA1

6c7d2db2fe156201c046c934a4d482518a66b5a9
SHA256

8173577d9d5435172b823238eb6994e6e96b57f0b8403126195d89f873db8aa1
SHA512

21fefdf9993cabc940c1dccda3dd9e0a8c8bc75d5380ca31e9cde81b17f204c34f8e6ae5eda7bec00f7080f80c4e59f7798c9270f6bd22939237a82061fb44c7
SSDEEP

12288:pQLXLPUEOGM9XDP35ghOsVeV4EpbBqSPS5rkNgqG0HgbXozjO888888888888W8/:Grl7M9XDP3ussq4EpbBqSPSa3a

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	31302936995b78f1bc5167aa1ce51f53_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\31302936995b78f1bc5167aa1ce51f53_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31302936995b78f1bc5167aa1ce51f53_JaffaCakes118.exe"
1⤵
- Checks computer location settings
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\wjaview.exe

Filesize
186B

MD5
ddd7b9de2762817229b19dcca8e0c7ee

SHA1
709f7e1d87760ac2fd5423af466ddfc04090f1bd

SHA256
ed0c11884bf8d6680a7b9d9f96795df47aeaec1390d1d27acc228f80199aa72a

SHA512
80af0d507dcf9daed8bf0e967618a5fc4b5541076527f8b3af458b480bbeb060ffb6d2fc6c54eac1c2aab7e18192b8a00b8b4e9ae3dfc8cb809bcac1b25d86ec

Download Submit
memory/3648-0-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3648-12-0x0000000000750000-0x0000000000824000-memory.dmp

Filesize
848KB

Download