1d7a57b2fc862d6301b4d40ebcbcfcc0e9bcb3ba69bea02486617b62af22960e

Analysis

max time kernel
141s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c782ae2288964a41fc5e5077d8a641d_JaffaCakes118.exe
Size

169KB
MD5

8c782ae2288964a41fc5e5077d8a641d
SHA1

4bca612805b21e44233469b7b147223ae8496059
SHA256

1d7a57b2fc862d6301b4d40ebcbcfcc0e9bcb3ba69bea02486617b62af22960e
SHA512

e65f24e509b0d36697107be498e681e1b47da440446120104bf144ad9b6378fafa5e8ae3f5a0829b53a35b57e5295372ffd1080bb172bf58481c71cb0a99e1bd
SSDEEP

3072:ISLEJYKou2ZR8GMFdrukEUTKSNrVMP0BByGXWGPAT7Zot9zH5FjA51K1kpYU8W6g:IiEJ9GMFJAY/ePV2+T7aNRa5p2W6RU6O

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	8c782ae2288964a41fc5e5077d8a641d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3280	fyk64ya.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c782ae2288964a41fc5e5077d8a641d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fyk64ya.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 3280	368	8c782ae2288964a41fc5e5077d8a641d_JaffaCakes118.exe	89
PID 368 wrote to memory of 3280	368	8c782ae2288964a41fc5e5077d8a641d_JaffaCakes118.exe	89
PID 368 wrote to memory of 3280	368	8c782ae2288964a41fc5e5077d8a641d_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\8c782ae2288964a41fc5e5077d8a641d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8c782ae2288964a41fc5e5077d8a641d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Roaming\fyk64ya.exe
  "C:\Users\Admin\AppData\Roaming\fyk64ya.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\fyk64ya.exe

Filesize
135KB

MD5
b34751f1999a8667eeb8cb664eda08e2

SHA1
533b097eb4b640615338bc93369fb177869bba29

SHA256
968aa9e9519a450799190d2186ac916924e13f04fae24bba69a2d1d63d185d01

SHA512
ee3b882af4f13058f555b5ae6b96d932cc935693728ea97c49d3ec38dc43522dd6d43f5fb9589789258c7bac9045655d4dec2d0693e4f633f739b15048192e4e

Download Submit