9a1cbb97aa01c6e3e1077c23aafbba48455bbe0691943c0cd68b0a6bf78883ea

Analysis

max time kernel
142s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3afe2f4d1e15d9e68c702c0482845b53_JaffaCakes118.exe
Size

465KB
MD5

3afe2f4d1e15d9e68c702c0482845b53
SHA1

bbe02fbcbc4ed8055661ec446120c2b9158e347c
SHA256

9a1cbb97aa01c6e3e1077c23aafbba48455bbe0691943c0cd68b0a6bf78883ea
SHA512

909340b3fb4a1c0ffaf8db027497b70f1af0df006afcc925be1d1dbcaefb79648bb172dc532dca0d9a498d4eebef1bc0d67141daf9377fb87a2654d562baa4ac
SSDEEP

12288:gutrzh9xOXkkZKbfeFGZlee8Y4TImjSMGpG7eXEdRZ0BMS924:gutr5OUkZIfK8AYdmjxLewBv4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	3afe2f4d1e15d9e68c702c0482845b53_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4904	Mod Seguranca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4904	4128	3afe2f4d1e15d9e68c702c0482845b53_JaffaCakes118.exe	84
PID 4128 wrote to memory of 4904	4128	3afe2f4d1e15d9e68c702c0482845b53_JaffaCakes118.exe	84
PID 4128 wrote to memory of 4904	4128	3afe2f4d1e15d9e68c702c0482845b53_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3afe2f4d1e15d9e68c702c0482845b53_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3afe2f4d1e15d9e68c702c0482845b53_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\Mod Seguranca.exe
  "C:\Users\Admin\AppData\Local\Temp\Mod Seguranca.exe"
  2⤵
  - Executes dropped EXE
  PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mod Seguranca.exe

Filesize
2.6MB

MD5
2288cfea252d90eb662fe4cb34babeca

SHA1
bbb928ff4fd4810183c28e38921beeebbf19ea9e

SHA256
49b6f74dd2f37f9381814792b8070edce717fa15d8af80be7150240ef01c72a1

SHA512
c2b504455a4d98816578144536ec2eed5610167f3d0f4e48d728faa7b356327c0b8d250559610ad602c80220d75d58290065af37572511dd0c11f31f71040457

Download Submit
memory/4904-9-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/4904-10-0x0000000004820000-0x0000000004AC1000-memory.dmp

Filesize
2.6MB

Download
memory/4904-12-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download