5929cdd4adcb86bee392fb40d9d818ad8bb6ca8eb95f20a3fb811f241d882590

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

620d5812adab1b259afa3c7cfc1a9420_JaffaCakes118.exe
Size

117KB
MD5

620d5812adab1b259afa3c7cfc1a9420
SHA1

c85301aac0836da13ec02a12c6ffca7b054d606a
SHA256

5929cdd4adcb86bee392fb40d9d818ad8bb6ca8eb95f20a3fb811f241d882590
SHA512

2dec3d54b7680961d5378155d0b393b234646372908a8b668985022b1b76b60fc2a1644e6ed79375beec6999c1ce22ca0fda2204d70e78b45f5af1f2ecf81dd0
SSDEEP

3072:ZFmI1FY0GrjCsBBdbdmS8gOY0NF4AKVJtrN43ZR:HRaCWdbduNVKVJz2z

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	620d5812adab1b259afa3c7cfc1a9420_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4956	2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\2.exe	620d5812adab1b259afa3c7cfc1a9420_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	4956	WerFault.exe	85

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3952	620d5812adab1b259afa3c7cfc1a9420_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4956	3952	620d5812adab1b259afa3c7cfc1a9420_JaffaCakes118.exe	85
PID 3952 wrote to memory of 4956	3952	620d5812adab1b259afa3c7cfc1a9420_JaffaCakes118.exe	85
PID 3952 wrote to memory of 4956	3952	620d5812adab1b259afa3c7cfc1a9420_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\620d5812adab1b259afa3c7cfc1a9420_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\620d5812adab1b259afa3c7cfc1a9420_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\2.exe
  "C:\Windows\2.exe"
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 224
    3⤵
    - Program crash
    PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4956 -ip 4956
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\2.exe

Filesize
103KB

MD5
a185d566bdc851a6cbfddb35fca6b992

SHA1
a9dd9927669549069188d11e9348e2111d1137ac

SHA256
d4b9fd07b5cb22b9e244f2ea1ba7df2e0b865ec5e0b0dc86ed595ca03deffd5c

SHA512
41d0ab2af60b6ed96f4269abe34689a896e3f72cb84da81a260a7046f427166d7f0d9b1ed8704006fcf838ed484b7787fde8b379bef6ec01a8dc74d3eff53785

Download Submit
memory/3952-0-0x0000000000400000-0x0000000000420200-memory.dmp

Filesize
128KB

Download
memory/3952-12-0x0000000000400000-0x0000000000420200-memory.dmp

Filesize
128KB

Download
memory/4956-9-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4956-11-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download