267e2f1993140068d727134c729c35aa214d3d9f3b89ae7565a07166e60d0e02

Analysis

max time kernel
135s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68095a702a281b766afb1f60c1469bf9_JaffaCakes118.exe
Size

98KB
MD5

68095a702a281b766afb1f60c1469bf9
SHA1

2dbf55f281ae301f02c52a907bca3917d1ca9acd
SHA256

267e2f1993140068d727134c729c35aa214d3d9f3b89ae7565a07166e60d0e02
SHA512

bf910a757610965c2018ec4a7f317dff07ecb532b9abc31df4528602bc43769f4632d82cc21f8d2d3e2c7e26de3fa4cd87124cdab0a68449e15c7980509a6ea4
SSDEEP

1536:g/qKFhy3nBiwgoCCVDezyQeWc3mJr91f443vlyXJ5M4m/:657y3BiwtFaNr9Z/lyXJnC

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	68095a702a281b766afb1f60c1469bf9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68095a702a281b766afb1f60c1469bf9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2296	2840	68095a702a281b766afb1f60c1469bf9_JaffaCakes118.exe	88
PID 2840 wrote to memory of 2296	2840	68095a702a281b766afb1f60c1469bf9_JaffaCakes118.exe	88
PID 2840 wrote to memory of 2296	2840	68095a702a281b766afb1f60c1469bf9_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\68095a702a281b766afb1f60c1469bf9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68095a702a281b766afb1f60c1469bf9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ecp..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ecp..bat

Filesize
238B

MD5
88674895e3bc9b20e91cd3357a4bc1e0

SHA1
cad8ef6e410cda869488bbc680b34cf9a975a69d

SHA256
f7a662a852230070ae7bca13ef005b1db0609838a4c93d76e29b3b721feca3b6

SHA512
b064f204dc8d3cdcb58d9da6f0f52a3a3b302bf8a62a55e717c47a7b537883433f6a289190861199d6e9decdd851caae1828da093629dc41e45101dd595b990b

Download Submit
memory/2840-0-0x00000000021A0000-0x00000000021B1000-memory.dmp

Filesize
68KB

Download
memory/2840-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2840-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2840-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2840-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download