52e533bbe35aaaedd8b2e9c7cffb6282914be8a413ff63158d33f37a3a7e5a3c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70bb05e78c599bb8055390ad2c954524_JaffaCakes118.exe
Size

75KB
MD5

70bb05e78c599bb8055390ad2c954524
SHA1

a29ac20ff827407fa5e105d1e5697232ba448d4b
SHA256

52e533bbe35aaaedd8b2e9c7cffb6282914be8a413ff63158d33f37a3a7e5a3c
SHA512

a9a1b8ffb680c28ff73c7d881409e2e94abe1d1c4eef9b61ff9059967b1008e37fba9c6c1fe633aa3e396776cd19fa01e6ee1ddae9e9b2391123afc159eee80a
SSDEEP

1536:vYSOeZK8n1xu3aGujkngFFBAUxObQpxqDV:vYSOCKsAq5jBPK8SLV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	70bb05e78c599bb8055390ad2c954524_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70bb05e78c599bb8055390ad2c954524_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1976	4416	70bb05e78c599bb8055390ad2c954524_JaffaCakes118.exe	86
PID 4416 wrote to memory of 1976	4416	70bb05e78c599bb8055390ad2c954524_JaffaCakes118.exe	86
PID 4416 wrote to memory of 1976	4416	70bb05e78c599bb8055390ad2c954524_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\70bb05e78c599bb8055390ad2c954524_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70bb05e78c599bb8055390ad2c954524_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ijb..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ijb..bat

Filesize
238B

MD5
7b8cd6c7942ca36b3deb5b1db0be28d2

SHA1
584bbee26ac66817f6ff23058480c2899e894586

SHA256
dad24571472639f2381d4ae7fd69a768a4141f163463cb0db21c67b3dbb308c8

SHA512
c5c07befa36cefc45039ae82e693e165b3b89aa0483dcacf7ad51f4387b2eda948e7a606f8c9992be60ee008574fa758ecfe686916cfc940ae0fa900494ced2d

Download Submit
memory/4416-0-0x0000000002080000-0x00000000020AB000-memory.dmp

Filesize
172KB

Download
memory/4416-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4416-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4416-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download