9717654d1b24072f2ba0752e46b570af3ce4d997ea42651983a94ba97d82dfb5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7850cbb973fde8b95d088430d5488565_JaffaCakes118.exe
Size

157KB
MD5

7850cbb973fde8b95d088430d5488565
SHA1

8f40bff3b7eca618096b28c9a6b17ebc1fc7e392
SHA256

9717654d1b24072f2ba0752e46b570af3ce4d997ea42651983a94ba97d82dfb5
SHA512

9a0f275632b3279e7a012b954e58e81bbe643a4417b11b07967a58a9f80f36fd49dc95adc0e571c7717a1ec0d4cf864fd3d45eee3130aab7d019f7140feb44d0
SSDEEP

1536:IrW2rWtLDUjKm79U7Qnv74/fR9CuT11kIBakvWZ3PvQu8:Ir0K79U7Qnv7AfBTDkp9Xs

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	7850cbb973fde8b95d088430d5488565_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7850cbb973fde8b95d088430d5488565_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 1612	3788	7850cbb973fde8b95d088430d5488565_JaffaCakes118.exe	86
PID 3788 wrote to memory of 1612	3788	7850cbb973fde8b95d088430d5488565_JaffaCakes118.exe	86
PID 3788 wrote to memory of 1612	3788	7850cbb973fde8b95d088430d5488565_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\7850cbb973fde8b95d088430d5488565_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7850cbb973fde8b95d088430d5488565_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Akj..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Akj..bat

Filesize
238B

MD5
9c120d75e968b897db55b0326d60fd9d

SHA1
78a60e4ad4f62b97213473ec9af7ec419cad5a33

SHA256
1cbde4099d56e5ea8d47bab7da34f5c38c2c333d1e23d2727e132593dd34e5ce

SHA512
616a5e3851ec0e40f688ba2b2bd82e031aa53db035114534ae3e31e9f1cacf45ee5142a18f16e711797f1d9ed1588debb2c9143e15e5e5b4df9dadf6141741f6

Download Submit
memory/3788-0-0x00000000021B0000-0x00000000021C5000-memory.dmp

Filesize
84KB

Download
memory/3788-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3788-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3788-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3788-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download