11c24971ea8a9db5632a15e8e4f644587cfc45c1bb31fafcf4a9dfd6854aa0c5

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ade53f7c92ff944f2fde2ee644bdb85_JaffaCakes118.exe
Size

123KB
MD5

6ade53f7c92ff944f2fde2ee644bdb85
SHA1

6f0cebbfc2c14277e5d647f44fe5738add58ad16
SHA256

11c24971ea8a9db5632a15e8e4f644587cfc45c1bb31fafcf4a9dfd6854aa0c5
SHA512

df20047ccd293cd6327c2e8df7044ad95bf6008c678d32a743c8d2fb0b10958c8d63dbcfae2fde7fac731991792620763c7324f7a44b56278fd2ea6c12ff8865
SSDEEP

3072:SMQ3wb4ww8/uNOo95QJrUs1J6JjvCwZ+:SMQywZlmR12Je1

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	6ade53f7c92ff944f2fde2ee644bdb85_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ade53f7c92ff944f2fde2ee644bdb85_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 228	4948	6ade53f7c92ff944f2fde2ee644bdb85_JaffaCakes118.exe	87
PID 4948 wrote to memory of 228	4948	6ade53f7c92ff944f2fde2ee644bdb85_JaffaCakes118.exe	87
PID 4948 wrote to memory of 228	4948	6ade53f7c92ff944f2fde2ee644bdb85_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\6ade53f7c92ff944f2fde2ee644bdb85_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6ade53f7c92ff944f2fde2ee644bdb85_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Tsz..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tsz..bat

Filesize
238B

MD5
7dd33985c1ab405c22de5e41469a75d1

SHA1
a87b7d38528eee91b740faf8c842f1bbdacf368b

SHA256
f23ad38c6ee2c621bff58754746436461438652b6c5e5b25cf56f72a1e031170

SHA512
a1a927de84dd4d0295bc53757ae5360f966a89ee88138341c430647a40beff6fb29c2b6d9a72adcca05c2586357b236dd346d1b4c49143c6c3f1fca73c1e5ff5

Download Submit
memory/4948-0-0x0000000000409000-0x000000000040B000-memory.dmp

Filesize
8KB

Download
memory/4948-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4948-2-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4948-3-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4948-5-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download