0228358f09dbdd68b5fe8b554ddb8c66448e37f76825c64719946474058a38d6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe
Size

224KB
MD5

820a2fbf02521cc216168c64e5964aec
SHA1

0748e3dfe373ffb6c4ac73608ac0996fd530ac50
SHA256

0228358f09dbdd68b5fe8b554ddb8c66448e37f76825c64719946474058a38d6
SHA512

632effbdbf1127270f6f9c28501dddc236f899756903405469628d8c697a6847c27d4f5271b0b1e65c1c749c84f39360b50b944dde46ea3df9319bbb18180eab
SSDEEP

6144:1cPDbOuy//oSj3b1jpwE9vApXGTWLyAe912PECr2yo:uPDSESr7vA1JLyP2PAyo

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000\Control Panel\International\Geo\Nation	820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1056	UnPackMe_AR Crypt Private.exe

Loads dropped DLL 2 IoCs

pid	Process
4204	820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe
4204	820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\aplib.dll	820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UnPackMe_AR Crypt Private.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4204	820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 1056	4204	820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe	85
PID 4204 wrote to memory of 1056	4204	820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe	85
PID 4204 wrote to memory of 1056	4204	820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\820a2fbf02521cc216168c64e5964aec_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\UnPackMe_AR Crypt Private.exe
  "C:\Users\Admin\AppData\Local\Temp\UnPackMe_AR Crypt Private.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UnPackMe_AR Crypt Private.exe

Filesize
405KB

MD5
14d84a4ba49e63eb6c9f9d27f91d8b38

SHA1
4797f88f02c9bfbf11407a8459d96f772a2a00be

SHA256
5f01d78a14d00b38a4539695e94d099e83002c96c5d8a0f5daf13a2ff3066424

SHA512
d98f743de869ad0e1f8742793ece3e9a6b629655f2a6b98030579eb754f9b3ac456b73fd0e63778c04929f36579fcba9f5b2ac3cfc94304d4b59e056738501be

Download Submit
C:\Windows\SysWOW64\aplib.dll

Filesize
12KB

MD5
35d174edd3c0bcfa9a32dce19e1abeb9

SHA1
c22638e64f8a5f34809811a2c286ae2f115028f8

SHA256
34194aa58d0eb70b513ea6a876a4f35ba6cc2f19c4fb6d408dd05580dcc74b04

SHA512
f807df3655e6dd0cea2412ae82aa7b3babe3862fa9eee5d38673ee30b26a528b9618e1a25d3a58ef1ff14be36a666fabd32968b5f4dc481539d2372b526c1ead

Download Submit
memory/4204-0-0x0000000000400000-0x000000000040790C-memory.dmp

Filesize
30KB

Download
memory/4204-20-0x0000000000400000-0x000000000040790C-memory.dmp

Filesize
30KB

Download