Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-08-2024 13:59

General

  • Target

    8aa247c559e55f09c2b784e1b6ad110b_JaffaCakes118.exe

  • Size

    650KB

  • MD5

    8aa247c559e55f09c2b784e1b6ad110b

  • SHA1

    2e3441da3562bc104cce5324eea82d3904ef9542

  • SHA256

    4d31a323ca23029aac338fa7a75b2a1c74ffb84aa76235b3565ad7c092e9f74d

  • SHA512

    570cf797c299bc9b0d11eefdaad741668f45cd477e094f1e0066338a008b65150500de847f0711ca9079bfb1ccc3181212b4a425e6ad9dffb7cf8eaec6a583e4

  • SSDEEP

    12288:p81Ed0hYcVhG6P32wykQzIin355k2GVpSx697YZRRy2OsNdNs:p81EdVcVc6Pg+pSxGYzR5rm

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8aa247c559e55f09c2b784e1b6ad110b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8aa247c559e55f09c2b784e1b6ad110b_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Windows\Temp\adobeupd.exe
      "C:\Windows\Temp\adobeupd.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Temp\adobeupd.exe

    Filesize

    1.4MB

    MD5

    8c0a7fcce648ba9908f4226cbf54cc55

    SHA1

    827f34ff32cdf64b99b6dcfb0a1ebf3e0b91eb85

    SHA256

    34cf73ea15efe98dbe1a35392f68e4c132bb672a14512450587454bba826c4b2

    SHA512

    776bfd0f609d76211d79acee90cd775ad28ccec26eeb481bbefb1f7241a68b48687a71ed3c284aa83211db8dcc0ea44bc64d48cc2643e212638e508bf11462f5

  • memory/4056-9-0x0000000000730000-0x0000000000731000-memory.dmp

    Filesize

    4KB

  • memory/4056-10-0x0000000000400000-0x0000000000566000-memory.dmp

    Filesize

    1.4MB

  • memory/4056-12-0x0000000000400000-0x0000000000566000-memory.dmp

    Filesize

    1.4MB