c4ba8cefb6d47ca904e245cf23e72c8dbe101b9ec1637fe3ca5b38cd9f3e842a

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3da001419034135ee4206728083821b8_JaffaCakes118.exe
Size

44KB
MD5

3da001419034135ee4206728083821b8
SHA1

1d7751c68448aebfbe49f495ea4ebb3e7236a54e
SHA256

c4ba8cefb6d47ca904e245cf23e72c8dbe101b9ec1637fe3ca5b38cd9f3e842a
SHA512

630027b2322c64155f2b458fd63dccd4764f7f6eade3ddabc8212c2a4895f5681ceb62152cd10d38e23488fbb887b2e033d03469fa31ed97ee3d1ab9fa07a5f5
SSDEEP

768:WIrvmHwZ30VQdqgA3mILyCvyFBzIw5J8p4b:W0+HC30VQdbILh0P8p4b

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	3da001419034135ee4206728083821b8_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3116-1-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3116-4-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 312	3116	3da001419034135ee4206728083821b8_JaffaCakes118.exe	86
PID 3116 wrote to memory of 312	3116	3da001419034135ee4206728083821b8_JaffaCakes118.exe	86
PID 3116 wrote to memory of 312	3116	3da001419034135ee4206728083821b8_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3da001419034135ee4206728083821b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3da001419034135ee4206728083821b8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
238B

MD5
4bc306c7ab42edff245e5ed7e1197e26

SHA1
2cd71b8ef08d221a357d435e1c63b02b0c5a69d0

SHA256
d77fb67d5763db5c7b6e0bf76d7cfe892172ac451a712a2e3b7f43c5f4234e41

SHA512
24e844364846b67ccba624d51fcd02eda045d099643046f120c964a5c06f4c3483de7c5b107884dbe930c56364b1ddd4ef824c1f8e2aed6ec130a5093bee6cd3

Download Submit
memory/3116-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3116-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3116-4-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download