97242c4e64e7925bd73f1c8bdbd5ca75e25411ff1bba542806bb56c4b3e6e7de

Analysis

max time kernel
139s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5c64be8217f67d71978638310a07b199_JaffaCakes118.exe
Size

342KB
MD5

5c64be8217f67d71978638310a07b199
SHA1

ca2f4475614a678d7520ac361e01859112ce458b
SHA256

97242c4e64e7925bd73f1c8bdbd5ca75e25411ff1bba542806bb56c4b3e6e7de
SHA512

3de83d4c3c6e2b53e4630f122c308cc6e0f183b3d89e1786046c1ef395d61f7e2a7e632b92642546223f420e210539c76fadf75d605de9c8ea91dbf5ab90f40f
SSDEEP

6144:cUvv+vZMLxdoAlROTh0yIqM/zqPyFSF9I1M/q4cNoo+S/RtyW1Opw9v:9v+vsnbsl/hk1M/qrNooV/REWQpw9v

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	5c64be8217f67d71978638310a07b199_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\5c64be8217f67d71978638310a07b199_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c64be8217f67d71978638310a07b199_JaffaCakes118.exe"
1⤵
- Checks computer location settings
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.exe

Filesize
280KB

MD5
fa7e336dfbfb65e2b84254e860584011

SHA1
c0e6de032ee5d2db4374b736c43989adffa1ac55

SHA256
05a2d8f24799cf2f44477082e1a0ed4f64bd927397bdbc590244bdfc13b11950

SHA512
bc116396a3fa37c525cca3ac3d2d84f62c0bfe6ddd65e12d78608ef3fb7d720d4dbf40c01dddf5a6eb8b47ca35d52b858045f5fb58f80bdc8e818b615a79ce3f

Download Submit
memory/2796-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download