f108e5d985f287f9cd2e813a4ce78c484f5aa08e38fb79fc2d77722beddcecb0

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 03:34

Target

378e0adac2580d5ec0830fdefcff0630_JaffaCakes118.exe
Size

25KB
MD5

378e0adac2580d5ec0830fdefcff0630
SHA1

e712a7d8e0daaabf84f183fd1ef44800bf7ed24f
SHA256

f108e5d985f287f9cd2e813a4ce78c484f5aa08e38fb79fc2d77722beddcecb0
SHA512

3a3e9a4ff57f5afe399c3381af3b6b795b2358c693a836cb8a263db07c11e5ace3743dc8c79987f46d06f67ad7068c4f032f480788f11b145eed23bb2ee6d093
SSDEEP

384:ZQwCwWbHlgbQSbof/S9daJxqpqyLohNX9:HMlHSuJKqyLoh

Score

7^/10

persistence

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	378e0adac2580d5ec0830fdefcff0630_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\shutdownplx = "C:\\Windows\\system32\\shutdown.exe -s -c \"homoharri virus v1.0!!!\" -t 600"	378e0adac2580d5ec0830fdefcff0630_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	900	shutdown.exe
Token: SeRemoteShutdownPrivilege	900	shutdown.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 900	2872	378e0adac2580d5ec0830fdefcff0630_JaffaCakes118.exe	85
PID 2872 wrote to memory of 900	2872	378e0adac2580d5ec0830fdefcff0630_JaffaCakes118.exe	85
PID 2872 wrote to memory of 900	2872	378e0adac2580d5ec0830fdefcff0630_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\378e0adac2580d5ec0830fdefcff0630_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\378e0adac2580d5ec0830fdefcff0630_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\system32\shutdown.exe" -s -c "homoharri virus v1.0!!!" -t 600
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:900