8817a4c72f1003d33b5e46cd2e1926ae8a90ea074906c105ff29bcd82569fbe1

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70b8d479a17bcf83d42af2c2ac594ef4_JaffaCakes118.exe
Size

423KB
MD5

70b8d479a17bcf83d42af2c2ac594ef4
SHA1

23379f6d2162ef6858bb52659e9cafd8a90135d3
SHA256

8817a4c72f1003d33b5e46cd2e1926ae8a90ea074906c105ff29bcd82569fbe1
SHA512

09aab3a5d80cc9788fc78baedf8166c61bca5c09a1732db88e26b634f741c44acc8656d79c36f6eefddb251cf42a9e2b04777c646bb6399a2825c7b2609a56b6
SSDEEP

12288:gutrzh9xOXkPNdFRqmFecn8lpy7OehLBHiSe:gutr5OUPTumF3nopy7OcLJiSe

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	70b8d479a17bcf83d42af2c2ac594ef4_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3464	Mods Seguranca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70b8d479a17bcf83d42af2c2ac594ef4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mods Seguranca.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 3464	3456	70b8d479a17bcf83d42af2c2ac594ef4_JaffaCakes118.exe	86
PID 3456 wrote to memory of 3464	3456	70b8d479a17bcf83d42af2c2ac594ef4_JaffaCakes118.exe	86
PID 3456 wrote to memory of 3464	3456	70b8d479a17bcf83d42af2c2ac594ef4_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\70b8d479a17bcf83d42af2c2ac594ef4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70b8d479a17bcf83d42af2c2ac594ef4_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\Mods Seguranca.exe
  "C:\Users\Admin\AppData\Local\Temp\Mods Seguranca.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mods Seguranca.exe

Filesize
3.7MB

MD5
2e4a9f1507d10fd329ae90cc3fab01c3

SHA1
9438824445e1c1119d3fa9494a58f1f14ea0899e

SHA256
e3adb93ad1ad5d739d81d240ddff60bcc7e5344d835abefd3da2d4a68f5c0258

SHA512
b4baf45b90fe8e5462f081ab2cea0a21bfd0cd1dc15428af6a379af90422126daec7b9f93cd91675d087df296ede41a3fbc1df1f897eefde8261add444b8f060

Download Submit
memory/3464-9-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/3464-10-0x0000000004950000-0x0000000004CFD000-memory.dmp

Filesize
3.7MB

Download
memory/3464-12-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download