0db9896af0beec15ccd1d0b2d7a352ffdafc9a5a86a848c215a877d1b5dc304e

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe
Size

844KB
MD5

5cf52ce113dcf6c4e409abd9a1a5dbe6
SHA1

b75d9c1fa59a60b838cd6013f39f462aa83f6a05
SHA256

0db9896af0beec15ccd1d0b2d7a352ffdafc9a5a86a848c215a877d1b5dc304e
SHA512

6f6042248e2b06767f462d31e01dc3fcc27c0c6c785984b4a908b92a31dda762477261e787c0b8ac77fb7ccc30418d11e72a7c775fde28a7bf6fa1b75aad541c
SSDEEP

12288:gTZIPHxIgctEavwv/FONXHe6kFlv+NTGR6jG5laQxr1SKojYdU3Iqa/MAab2jIsr:DG9MvFvuGv+Qxr1SKoUs0ZjJC8J7

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3476	aaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2212	5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe
2212	5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3476	aaa.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3476	2212	5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe	85
PID 2212 wrote to memory of 3476	2212	5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe	85
PID 2212 wrote to memory of 3476	2212	5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe	85
PID 2212 wrote to memory of 3824	2212	5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe	87
PID 2212 wrote to memory of 3824	2212	5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe	87
PID 2212 wrote to memory of 3824	2212	5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5cf52ce113dcf6c4e409abd9a1a5dbe6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\aaa.exe
  "C:\Users\Admin\AppData\Local\Temp\aaa.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_xiaran.bat" "
  2⤵
  PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_xiaran.bat

Filesize
212B

MD5
aacb53483c93f08ff31f0657917d7c09

SHA1
7b0c3482bcd8af47a80fcd19a62fd8b9439011b6

SHA256
480e4d41b1294da711abeb402b033f5bb357255af22cf01e9b3d4fd52da55640

SHA512
18e3c6efe4b4227c6fec968c6b29dfb05df22cd1181cd300423c8413b723ad28f42838c8aecc1328628cddd11cc6550f3b9bbed1d9ad138186d559fcec3d897b

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaa.exe

Filesize
764KB

MD5
6321db16ab58bbe7e0320000aee870ac

SHA1
e25b0c4245718ac884c2060fc3826459d4113164

SHA256
3c662f22ee577a12ffce7ef600e84f5c9ea63123ad89ce2409038578b6834f9e

SHA512
221c3ce073669655ec5c414d6a620de61f726478f24e5f8fd0f95e21f26be154ab464448bf3ea97ead51950392c45e75aa0707c9bddbfb64b49de658614d510b

Download Submit
memory/2212-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2212-14-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3476-9-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/3476-10-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download