031b352e90e30f86d2f95027782ee6f359c8f898c23d09d441c74507a50e4ffd

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

88baa0f8356a4a85a5cf9b85f884d7da_JaffaCakes118.exe
Size

165KB
MD5

88baa0f8356a4a85a5cf9b85f884d7da
SHA1

765f88a8179da77c80b0509ad0e11241c09bd778
SHA256

031b352e90e30f86d2f95027782ee6f359c8f898c23d09d441c74507a50e4ffd
SHA512

e9bba6cbc71118e5cb1dd622d4a91fb1c68f6e60173beaecd3b4dc49c3beb4306e615c96e187ad0f6fc1bcb9e2cf859ae43aa42c7c46a6026f3afca0c4940081
SSDEEP

1536:5Ti19O1GvftOSn5FqosG3GpXwv3m3t7sCqUgel5CzP:A1hvF1jsZXyQeUgel5m

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	88baa0f8356a4a85a5cf9b85f884d7da_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88baa0f8356a4a85a5cf9b85f884d7da_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3064	2984	88baa0f8356a4a85a5cf9b85f884d7da_JaffaCakes118.exe	87
PID 2984 wrote to memory of 3064	2984	88baa0f8356a4a85a5cf9b85f884d7da_JaffaCakes118.exe	87
PID 2984 wrote to memory of 3064	2984	88baa0f8356a4a85a5cf9b85f884d7da_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\88baa0f8356a4a85a5cf9b85f884d7da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\88baa0f8356a4a85a5cf9b85f884d7da_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ktv..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ktv..bat

Filesize
238B

MD5
25cec35e3e7bf99c3c1f6c5c8de3810a

SHA1
ffee370095fc84819115b5bdb3c898ef1cd7687b

SHA256
0a358b91ca03fbe61ed7c20173addc8ae7fb95371f016df989a2c52a7dab0431

SHA512
7574cdf4088dddac6f43d1f7ad703e61e3ee9d6652c5d2cc35f2aac302a60bf52032a8afd7079beecfde4b17284b2b51760d8d78fe172b254380f5e8a6d19054

Download Submit
memory/2984-0-0x00000000021D0000-0x00000000021F5000-memory.dmp

Filesize
148KB

Download
memory/2984-1-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2984-2-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2984-4-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download