140c23fabef89e7d8797639694303a1ea0aee3f0aa8ee633c4e83464baec0721

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6586651cc7b6588de7bdd38ead464f22_JaffaCakes118.exe
Size

382KB
MD5

6586651cc7b6588de7bdd38ead464f22
SHA1

27d21f935f7940939fe91d03a52298c2606d948e
SHA256

140c23fabef89e7d8797639694303a1ea0aee3f0aa8ee633c4e83464baec0721
SHA512

54c0d67237ea11b385d9353728a7acf9f5a25024ffad11e90d0a28d44da2d677313f3d1cf8433cdafc790dbba49e1a88d59d6bc685bc8eef087a0c480eb8ef6b
SSDEEP

6144:G4lRkAehaKuqT+FOMgZTGguQXVCkQpDBTkqJAtmeElTeRe0/NCgXiPVGi:GkWAehJuqTHZT5FQBlVREeKNvXYz

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	6586651cc7b6588de7bdd38ead464f22_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1012	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1012	1636	6586651cc7b6588de7bdd38ead464f22_JaffaCakes118.exe	86
PID 1636 wrote to memory of 1012	1636	6586651cc7b6588de7bdd38ead464f22_JaffaCakes118.exe	86
PID 1636 wrote to memory of 1012	1636	6586651cc7b6588de7bdd38ead464f22_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\6586651cc7b6588de7bdd38ead464f22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6586651cc7b6588de7bdd38ead464f22_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Setup.exe
  "C:\Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Setup.exe

Filesize
280KB

MD5
a394877a49ea1be45553fd1cdd17ce22

SHA1
2d895b9ea8a2eb7f828cc0e76db1899a36f9d131

SHA256
79ceac666e87c82a059f523c2106a09f28a5b2f907a317768b502efdf841738f

SHA512
ee44f9c53e7c49fbe1f112daa10439c6b65bbdc09a8bae91a498c5d54e2758485bb9cc01fb4b3bd896e52c47cfd83b38775cbfff190dfaebbccb925aec04073c

Download Submit
memory/1012-27-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download