cd36ff17ea354bf7158865f7e1ad01f6dd60a4fe74460a12d8e56e3f2bd0cffa

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f81d7cfaa3f85db6cc7f5d4de899a52_JaffaCakes118.exe
Size

567KB
MD5

6f81d7cfaa3f85db6cc7f5d4de899a52
SHA1

9eddb395bc0bd52f051f6ac94055898edcc39262
SHA256

cd36ff17ea354bf7158865f7e1ad01f6dd60a4fe74460a12d8e56e3f2bd0cffa
SHA512

97887a733c659c5ab08d0c8836a5e6d96b1ec13f592ae3e78f14964bc1fe1c14e13efcfcdfa2fe9d6b5071b94b86f6fcffe3c4c5ffdb81f0ceb7a1b36072b54d
SSDEEP

12288:NJYIlIUr41owTtmHgYPW82ImgHTas8NrWr4YYARWP/yYaI1xCLo6yvk:NZlaTtmHJPWBImCTar84XH7x1s8Zs

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	6f81d7cfaa3f85db6cc7f5d4de899a52_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4912	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f81d7cfaa3f85db6cc7f5d4de899a52_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 4912	2120	6f81d7cfaa3f85db6cc7f5d4de899a52_JaffaCakes118.exe	85
PID 2120 wrote to memory of 4912	2120	6f81d7cfaa3f85db6cc7f5d4de899a52_JaffaCakes118.exe	85
PID 2120 wrote to memory of 4912	2120	6f81d7cfaa3f85db6cc7f5d4de899a52_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\6f81d7cfaa3f85db6cc7f5d4de899a52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6f81d7cfaa3f85db6cc7f5d4de899a52_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\banner.gif

Filesize
50KB

MD5
2bbfe6a0dfc9b9038b82d7183bf9c79b

SHA1
2a167441b84ab72dfc68696b0cfe5cc0209d3553

SHA256
a090f0a02ee737a47f5bcc7c8a7e30b0328f6448d05ae57101563a29693fdb28

SHA512
30c204243a5b8db8ecb6c8bdd32508129ed161ae0c515e677712845ea709d0f78f5093309f830eff5eaf7287fa9220565005e02e7fe7aa507241ac53f2ef9fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\grey_bar_710.gif

Filesize
1KB

MD5
8f37f672ca6923a9cc3b2d0f7007f6dd

SHA1
4be4c36139fbebdb0d5dc0593414aef850251a11

SHA256
93b5d88603d4aae07ea4d135b0b2de3efee8137221c8bcb64a28bee8e300dac7

SHA512
858f31a6be34f7f7ea849c5a805fb9b0f23cb5bdc2e710ed0bc72dfbe2ecd539ed21c3603038dd969232d4ce97e23f21855ab81a3cfac8a5d3640253811aabd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lang.ini

Filesize
2KB

MD5
119b482883e355b1489628f33ee9ef88

SHA1
aff3ddbd68ff41d116af1b64558b354b8d1c3dca

SHA256
83cea594ac7bb6b1fc78bfce814b129189309882ff0fe760ca6bba103292d299

SHA512
c4eaed2b17d69189c9514646fdfeed4d4e8190f992f1c13375224fc00ac2a99b7850de6eaf0f2b3ebb35b251f74b6d859b1052a06b5900d0fbef25c84f6c0a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe

Filesize
835KB

MD5
36a25ebfbeefe809b692a48853ad0721

SHA1
1baf55b5a63d68be8b84c0f36555fd6207ee41dd

SHA256
85fdb70a131d0cc7fa4b5d713dd72c39802bdd0cf0b7bb6f2d574097a5bd3ac3

SHA512
574d992e87ff5deff615ca56e8ef63616d6d44cf121e68dd72e2ee7823e1a31f9a882261068aab1c7fcdf2f1dd6cc7aa653f7c6f9096893dbf43b41555c5c1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.ini

Filesize
6KB

MD5
8b3e332a775bb55b0a575d5606d19ce4

SHA1
bfb4ced5aed6bdf8e415a59c29427bcb09135326

SHA256
3429bd7ab2f870abbf0948895ff5697c038369fc4bd594deabba31edb130a83b

SHA512
fe3695c25337c7f69587e4c8a7bb7f542fdb006681365524623042edf64cf1c32a4d38470ebd5160b32e6aca45096abd9b315d59051dfd40c45ef59fb393baa5

Download Submit