253d8b5840076b9cb1d606268dc07ef0d96b23b2e2fb2b0ad1d2b5c7fef90a8a

Analysis

max time kernel
147s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

88815099db0398b363faa988422e4997_JaffaCakes118.exe
Size

6.5MB
MD5

88815099db0398b363faa988422e4997
SHA1

322c73f8b984dd64bce1e056f0283e45344fc98e
SHA256

253d8b5840076b9cb1d606268dc07ef0d96b23b2e2fb2b0ad1d2b5c7fef90a8a
SHA512

c1c33aef3a0f019547dfb6613a82a7c6b830d29fd1f8bfbe56298822dc27b14866bfbdc97ec011aaf5410933534e5885efd5c51e59c6555e655bf0ee45b03e67
SSDEEP

768:ToyzZ7iG6u4PtaGhgJ+VqQtKHPsd7MZe8PTSaSftJUJmJ1Ltpgab:97JcaGhWSFKsd7MZe8POHfn/pgab

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	KB416588.EXE

Executes dropped EXE 1 IoCs

pid	Process
3588	KB416588.EXE

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRAM FILES\WINDOWSUPDATE\KB416588.EXE	88815099db0398b363faa988422e4997_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\WINDOWSUPDATE\KB416588.EXE	88815099db0398b363faa988422e4997_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88815099db0398b363faa988422e4997_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KB416588.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 3588	460	88815099db0398b363faa988422e4997_JaffaCakes118.exe	84
PID 460 wrote to memory of 3588	460	88815099db0398b363faa988422e4997_JaffaCakes118.exe	84
PID 460 wrote to memory of 3588	460	88815099db0398b363faa988422e4997_JaffaCakes118.exe	84
PID 3588 wrote to memory of 1284	3588	KB416588.EXE	87
PID 3588 wrote to memory of 1284	3588	KB416588.EXE	87
PID 3588 wrote to memory of 1284	3588	KB416588.EXE	87

C:\Users\Admin\AppData\Local\Temp\88815099db0398b363faa988422e4997_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\88815099db0398b363faa988422e4997_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460
- C:\PROGRAM FILES\WINDOWSUPDATE\KB416588.EXE
  "C:\PROGRAM FILES\WINDOWSUPDATE\KB416588.EXE" C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\88815099DB0398B363FAA988422E4997_JAFFACAKES118.EXE
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /Q del C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\88815099DB0398B363FAA988422E4997_JAFFACAKES118.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WINDOWSUPDATE\KB416588.EXE

Filesize
14.0MB

MD5
caf31188d2d8905e5d40f56bb5535d52

SHA1
4e703eefb7a54c9f8a591b7afe911fbd6ff6eaaf

SHA256
ddd29ddc95a619c1477945de77418d9ac5f423ef1f95877b62fa957123a1eae1

SHA512
4dc0e9be441bdb9cae5aef6b664272420db9aa72574e982a1580997849beeb225036e9de1e9dda27a2bb0024d90188a76a967a3a493e24e6ab1d2e65a94149b8

Download Submit
memory/460-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/460-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/460-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3588-10-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/3588-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download