3dd58f7d4448eb74d1a3fecd9426cd7b72695043ef59d79674a57cfc3d8f97bc

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e30270cf7f9ebf027a1bdbd64ecd3ad_JaffaCakes118.exe
Size

68KB
MD5

3e30270cf7f9ebf027a1bdbd64ecd3ad
SHA1

89b0018ae95d1c817f1d86cf2213d0326f3b3c7e
SHA256

3dd58f7d4448eb74d1a3fecd9426cd7b72695043ef59d79674a57cfc3d8f97bc
SHA512

defc3fd92f38e0a158111605e04f7dbcd9f731a9d15b8e569531a5a36c54f510dea05c5595c27274fffcec91841daae48b3eec7823301ef2765fd9eb129c4540
SSDEEP

768:RWwBmR2RGG/H+7umXry9meCIMCBD8loQEF249cedMMNr8mGHFr7GlhpZ0ayeyGkC:Rxm21+KmXG00BDUoHLldtoRFmlZjA7Z

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\International\Geo\Nation	3e30270cf7f9ebf027a1bdbd64ecd3ad_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3e30270cf7f9ebf027a1bdbd64ecd3ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e30270cf7f9ebf027a1bdbd64ecd3ad_JaffaCakes118.exe"
1⤵
- Checks computer location settings
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2624-0-0x0000000000270000-0x0000000000281000-memory.dmp

Filesize
68KB

Download