869163232563ac7c5e438842a4b5cdd8c8c308062c6f7014bfe76851be9738f9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dedab92a45af6bf9691bce6dce18eef_JaffaCakes118.exe
Size

398KB
MD5

3dedab92a45af6bf9691bce6dce18eef
SHA1

3dd800257d4631cf9e055f426a584dc84f1dc426
SHA256

869163232563ac7c5e438842a4b5cdd8c8c308062c6f7014bfe76851be9738f9
SHA512

17aad162660578bb16ac8a7d5a921776026d274ea9efba7ec0ad2f5d5e205937b0f70a740efd796f37572b267eb29d228b2a453588a0d0e9c317778a45f6ea49
SSDEEP

12288:gutrzh9xOXkk6fDYBUsdYmgTLZguBodFLPIhzhSdb:gutr5OUk6f+UsvkFgsIChEb

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	3dedab92a45af6bf9691bce6dce18eef_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3336	Plug de Seguranca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 3336	4032	3dedab92a45af6bf9691bce6dce18eef_JaffaCakes118.exe	86
PID 4032 wrote to memory of 3336	4032	3dedab92a45af6bf9691bce6dce18eef_JaffaCakes118.exe	86
PID 4032 wrote to memory of 3336	4032	3dedab92a45af6bf9691bce6dce18eef_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3dedab92a45af6bf9691bce6dce18eef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3dedab92a45af6bf9691bce6dce18eef_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\Plug de Seguranca.exe
  "C:\Users\Admin\AppData\Local\Temp\Plug de Seguranca.exe"
  2⤵
  - Executes dropped EXE
  PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Plug de Seguranca.exe

Filesize
2.1MB

MD5
757c6017992c9359adaceac23cac6766

SHA1
f34b09391c8cb6d4b80cea46db05393e967c73c0

SHA256
548284400e672b3efe8699c7830b1a874019a11d74986708e9943fe408b021e3

SHA512
5f20f1545e595a6d6e87d9bef2d37cca2fb7aecbfcc923f78c547567435cbd1cebe2b877d406a7e2301059c3ae31389f1676cb0e02244c7633223b3e480b68c9

Download Submit
memory/3336-9-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/3336-10-0x0000000000050000-0x0000000000274000-memory.dmp

Filesize
2.1MB

Download
memory/3336-12-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download