9638581a59653c0d6f01110be90cfaf13b15ab91b3839ee9d46dce33f26e6a2b

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

633b2db9da9af8ce7f6c14acbd24770a_JaffaCakes118.exe
Size

370KB
MD5

633b2db9da9af8ce7f6c14acbd24770a
SHA1

7c6d4fc0cddb0213fc98421167f75e5d7afe27fe
SHA256

9638581a59653c0d6f01110be90cfaf13b15ab91b3839ee9d46dce33f26e6a2b
SHA512

fac63132db6d52d55c10618dac00f3b4ffe7cc1ddc5284dd90da5e24f447366273aea7712590ab36a2f243535e7c095c4b29bef9f6ba54db4b3993ee55a52172
SSDEEP

3072:zXjoutudpVpg4fq0SjJpyHwwwkrqxGrDgaghZuRaaaPaAtzVSR+5MCG:zXjoSEVC4fq0QWBrrDz3WtzVSA5MC

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	633b2db9da9af8ce7f6c14acbd24770a_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 1 IoCs

pid	Process
1796	b2e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1788-0-0x0000000000400000-0x00000000004BF000-memory.dmp	upx
behavioral2/memory/1788-11-0x0000000000400000-0x00000000004BF000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1796	1788	633b2db9da9af8ce7f6c14acbd24770a_JaffaCakes118.exe	84
PID 1788 wrote to memory of 1796	1788	633b2db9da9af8ce7f6c14acbd24770a_JaffaCakes118.exe	84
PID 1788 wrote to memory of 1796	1788	633b2db9da9af8ce7f6c14acbd24770a_JaffaCakes118.exe	84
PID 1796 wrote to memory of 5104	1796	b2e.exe	85
PID 1796 wrote to memory of 5104	1796	b2e.exe	85
PID 1796 wrote to memory of 5104	1796	b2e.exe	85
PID 1796 wrote to memory of 1708	1796	b2e.exe	90
PID 1796 wrote to memory of 1708	1796	b2e.exe	90
PID 1796 wrote to memory of 1708	1796	b2e.exe	90

C:\Users\Admin\AppData\Local\Temp\633b2db9da9af8ce7f6c14acbd24770a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\633b2db9da9af8ce7f6c14acbd24770a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\7947.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\7947.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\7947.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\633b2db9da9af8ce7f6c14acbd24770a_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ADD.tmp\batfile.bat" "
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7947.tmp\b2e.exe

Filesize
8KB

MD5
b59836f8bce4b7a9c5c44bd3d77bbc05

SHA1
deef3c038817d8af51ebae1c9b547bdeafe90500

SHA256
82b620227e2ff4eecdc396367ef3cd090db387d5fa9c28be98296892acbe0952

SHA512
ba329fecfd4367fdc26b9daa3974e62d27b4763d850f182246ad2f27f8dcb445ec803b576d617d93881d774f2b19a437fef0909c8a637ec9fc2b3380113095d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp\batfile.bat

Filesize
158B

MD5
2ebd35710cdf46a6bfc1b7a9a573e991

SHA1
c52403395a0b51b50cd550e97d8cc260605bc873

SHA256
52ca6a8fe69ab59ca99b72500f5a9baadbe277ca0dea6dd8462acb322678a146

SHA512
d2907d3fe5c3c44f8fb08e233671a9cf268f647e9cd7780c46b3db7afe74b5c59a410ac4993dd5e5a928b6dc5e95d31e6bebc34e1bf9746b6dab6283d798ea8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\selfdel0.bat

Filesize
158B

MD5
be0073dbe8a88ce1ab92ba8621132e80

SHA1
97dafba9935d5f526d541e71ca8dcdc2853c14c1

SHA256
c0e9de5f4f9fe0a9d0ae1d6102dd97dad70b76cb5610b0100c186513412928cb

SHA512
edf5b838c63dbd24b3d823f231f54333eee798aa44e6aa505442ed304f71f17685240c8243c78807a41d9d58c9ea0333a89b7fa6bce64dbea57e18b9e6f97df7

Download Submit
memory/1788-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1788-11-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1796-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1796-19-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download