d0febb523d4b49a32d2a198ae462ee2c471bf25a867e64101b99bc2718660eaf

Analysis

max time kernel
95s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe
Size

90KB
MD5

3359aa9f1da47acf7aaf4601f6b09ee9
SHA1

60bbfec3435e89c340976503a9514e74488538e8
SHA256

d0febb523d4b49a32d2a198ae462ee2c471bf25a867e64101b99bc2718660eaf
SHA512

406a6deb75e36d4de8a36af9b4decb4fcf49a06269a670c0dab53e7f5c2b44d4c0775d62a2534816b58930e5f1e0584095a8f6418b1bbdc0d6144681a1128041
SSDEEP

1536:agECp9k18iCodmBVBQtJLm1JFn1wVVrkZ/THkZ/TgmDs7hMC1E6rXaHyZ0IGiuIp:agFpCmjBQa1Xn6VVr2LH2Lg6s7hMqrq2

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4860	SkypePM.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SkypePM = "C:\\Users\\Admin\\AppData\\Local\\Skype\\SkypePM.exe"	3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2668	2316	3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe	84
PID 2316 wrote to memory of 2668	2316	3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe	84
PID 2316 wrote to memory of 2668	2316	3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe	84
PID 2316 wrote to memory of 4860	2316	3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe	86
PID 2316 wrote to memory of 4860	2316	3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe	86
PID 2316 wrote to memory of 4860	2316	3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3359aa9f1da47acf7aaf4601f6b09ee9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r.bat" "
  2⤵
  PID:2668
- C:\Users\Admin\AppData\Local\Skype\SkypePM.exe
  "C:\Users\Admin\AppData\Local\Skype\SkypePM.exe"
  2⤵
  - Executes dropped EXE
  PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Skype\SkypePM.exe

Filesize
90KB

MD5
3359aa9f1da47acf7aaf4601f6b09ee9

SHA1
60bbfec3435e89c340976503a9514e74488538e8

SHA256
d0febb523d4b49a32d2a198ae462ee2c471bf25a867e64101b99bc2718660eaf

SHA512
406a6deb75e36d4de8a36af9b4decb4fcf49a06269a670c0dab53e7f5c2b44d4c0775d62a2534816b58930e5f1e0584095a8f6418b1bbdc0d6144681a1128041

Download Submit
C:\Users\Admin\AppData\Local\Temp\r.bat

Filesize
159B

MD5
65c3ccb5f21dfcc34dc26f6fdd74e187

SHA1
3f64e48c68fa0efd47349171700d90c73ceb21a0

SHA256
ed1289e5ec36a153f5c8a89780419d28c54f3ddb5ae60faec6f760690a223d90

SHA512
f5e7a31716853a41d4681d8783e5958c30e552ccd4adab626753aac4ec08ecbcfbd9deab085d1f297891dd071f3f1c3f7df055c6a366bd6044e465ae1199ac6f

Download Submit
memory/2316-0-0x00000000006E0000-0x00000000006EC000-memory.dmp

Filesize
48KB

Download
memory/2316-1-0x00000000006F0000-0x0000000000709000-memory.dmp

Filesize
100KB

Download
memory/2316-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2316-19-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2316-17-0x00000000006F0000-0x0000000000709000-memory.dmp

Filesize
100KB

Download
memory/4860-21-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4860-20-0x0000000000580000-0x0000000000599000-memory.dmp

Filesize
100KB

Download
memory/4860-18-0x0000000000550000-0x000000000055C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads