9a7aff2310831face11c151ecd8f8ee19c36570ad26124eaa42e323b617a04a3

Analysis

max time kernel
148s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe
Size

2.0MB
MD5

5d3e9806b97e8321e23a20ce88caa48b
SHA1

7216a9b6930cee320e9b5062a346f93116c445cf
SHA256

9a7aff2310831face11c151ecd8f8ee19c36570ad26124eaa42e323b617a04a3
SHA512

4cd16f46fc80a9ccc4d46e3cc2fe74600cf23eba0aeac19f88c795f8502d632f13186890ef51e2ea3cb3fdedc650c47165b759e35733f90e50568a6a06fabb3c
SSDEEP

49152:0aRhyb24ycJbGOWfwcWAgAYtcpvyTBzJwOnTo:5RhWBkwcXg1icltXnE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp

Executes dropped EXE 2 IoCs

pid	Process
3488	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
532	rkverify.exe

Loads dropped DLL 4 IoCs

pid	Process
3488	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
3488	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
532	rkverify.exe
3488	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe
532	rkverify.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3488	4848	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe	84
PID 4848 wrote to memory of 3488	4848	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe	84
PID 4848 wrote to memory of 3488	4848	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe	84
PID 3488 wrote to memory of 532	3488	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp	93
PID 3488 wrote to memory of 532	3488	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp	93
PID 3488 wrote to memory of 532	3488	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp	93

C:\Users\Admin\AppData\Local\Temp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\is-JHFJK.tmp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JHFJK.tmp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp" /SL5="$F0052,1758437,211456,C:\Users\Admin\AppData\Local\Temp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Users\Admin\AppData\Local\Temp\is-GAG2R.tmp\rkverify.exe
    "C:\Users\Admin\AppData\Local\Temp\is-GAG2R.tmp\rkverify.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CSMA8A4.tmp

Filesize
160KB

MD5
5ac09190daf249c3e93c3ac961067024

SHA1
bad9c0d552d54310f669d66b549dcada90583812

SHA256
f4934185f75518a13ef5425959f47516cc8467f513e838a82e749ffb782d7e23

SHA512
2a87686c038e8a34f8e04a844726de564a08baeedc87632219b86f455d5222efe2ed7557fad9658627e304d916a75cfcb3c9dede4e72057a070f64370aa52f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GAG2R.tmp\FileDe.dll

Filesize
385KB

MD5
10bb1bda06871deb8d0506b4f6390b6c

SHA1
ac96f51cb1f1d9e341eca88b47a734bfb1e3f494

SHA256
0124f82f392a3156edc5380f28ac19caecc89682a7556f28a2172681d923ac84

SHA512
01afabb1f5458bf928787c69b4078f5ba738ff427989aa6a3775c8bac659f98b81e4c4acccaf093815afea7bad37bda0cfb07c088bac4eda2fdf149003e3aa62

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GAG2R.tmp\rkverify.exe

Filesize
268KB

MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JHFJK.tmp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp

Filesize
841KB

MD5
077ba43e4c4652f5c9527a12f015fd67

SHA1
c879d5b76642aa4ad76e77f1b58c4af58ba12edd

SHA256
b0846555df7c199b5fff2ec29f98ac8eec0e7046a8f201753406c379e89adf92

SHA512
6ffebc613d25d8006af66e4d3df56b2c9acaae89204451a0e609426ae45ecb576910bd9534d2c67a01d9207988053140841b00303f84b3d061038e35ce52b3c1

Download Submit
memory/3488-7-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3488-17-0x0000000003120000-0x0000000003186000-memory.dmp

Filesize
408KB

Download
memory/3488-40-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3488-42-0x0000000077010000-0x0000000077034000-memory.dmp

Filesize
144KB

Download
memory/3488-41-0x0000000076C60000-0x0000000076E00000-memory.dmp

Filesize
1.6MB

Download
memory/3488-44-0x0000000003120000-0x0000000003186000-memory.dmp

Filesize
408KB

Download
memory/3488-43-0x0000000076130000-0x000000007620C000-memory.dmp

Filesize
880KB

Download
memory/4848-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4848-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4848-39-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download