0160a8646367fe389f9cab8230b2f93546165abe0d5b222dfe040a03e3fb3cc7

Analysis

max time kernel
132s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

652ffe20ff7c0a9534ae014fb84042a8_JaffaCakes118.exe
Size

1.9MB
MD5

652ffe20ff7c0a9534ae014fb84042a8
SHA1

aa27c34b49ce49e9ab7e75c02b35696bcedfab24
SHA256

0160a8646367fe389f9cab8230b2f93546165abe0d5b222dfe040a03e3fb3cc7
SHA512

87026959cab0287a7cbbb1ba6e133896a4d32fde3dd4e8ffb2c24fe698f0d39cf307c1daff1a408000b1962dd06b3d7a3d88c377afb633036c03ba88fc941ea8
SSDEEP

49152:dh9BQXNACvVS6JJan/DTSV/V6MGdiyfTK756N:tY+D+P6MGdiyusN

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	652ffe20ff7c0a9534ae014fb84042a8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3968	4480	WerFault.exe	83
1084	4480	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\652ffe20ff7c0a9534ae014fb84042a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\652ffe20ff7c0a9534ae014fb84042a8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1400
  2⤵
  - Program crash
  PID:3968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1348
  2⤵
  - Program crash
  PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4480 -ip 4480
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4480 -ip 4480
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ntdete.exe

Filesize
10KB

MD5
e90bd56960a8d74a830e7ff46d08e1c1

SHA1
6e1d058da7c770d6d984f0e114a097e7a8ff7aef

SHA256
9c86c58efa05fb3d0513edbb27e0489938e2fe41beecec67a1ee28d4c87e29b1

SHA512
06564afef751f8d39a1ebee4c739595f1ae7232c03de0f5b9c7f5fc279809f071a806f80e13bbf67dd70bad3d5df3b39a030be880444aad75d61023a3c46b7e4

Download Submit
memory/4480-0-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/4480-37-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download