3f8f4ca809785ab87a70fba16ac66360860f4cb9e98b0a584b359693b9883838

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93cb85869373f0ecf48da9ca1e8afc21_JaffaCakes118.exe
Size

47KB
MD5

93cb85869373f0ecf48da9ca1e8afc21
SHA1

cfafc3394a10e1d71b1ebc9ed6ac1cb0172ef469
SHA256

3f8f4ca809785ab87a70fba16ac66360860f4cb9e98b0a584b359693b9883838
SHA512

c3b63bdafa2791c64b45fbb0c7fb51b659a93bb6b5d8fdb1ace196bc321dbb9fc0043dcbace0d7ef184acdc07987894600e5a0dcee08d0cbbd1d8627313f1eb7
SSDEEP

768:R8EVIpBU9hE6W0TfiPzikZ+VfW+KgyCSq0zjffuHFoooBojjjjjjjjjBjjjjjgEZ:OEqpEO10diWfWecvzWOd6

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	93cb85869373f0ecf48da9ca1e8afc21_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93cb85869373f0ecf48da9ca1e8afc21_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\93cb85869373f0ecf48da9ca1e8afc21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\93cb85869373f0ecf48da9ca1e8afc21_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\plugs\mmc172.exe

Filesize
47B

MD5
2079de86c2f563b129b99bacca34ac23

SHA1
9cd346283354dbae0118488be07b73e6a9292a1a

SHA256
57e5a4c140bcc8738d1daa3f6cee05aac052218d286f69e4f4303fbc8af19ea7

SHA512
946e89de4a2df78bc3952bb79843c95b137e0494ffba3e0b956aa1073beaf759d14fed9ea033adc2cee1aa8cc272b5a8ea6e23ae74caaf196ff73b555466706a

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\plugs\mmc225.exe

Filesize
47B

MD5
8cebbdcf906d7e7b80bc34904e9bd904

SHA1
9aec1585ae48f2744c74447391b450fc2c972a0f

SHA256
68227354e364f4637416a15ab0d7e98a83deda10e3ce98dd134f0cea55b74573

SHA512
aa7cf43a3c80c8df522e95a763c07be226fb5b53727bee8f4076c0d7a5f7000c08832ca226838ea43554cdf12145db4a9fb67cb3176d19d3f275bdfb20d11b22

Download Submit
memory/2180-0-0x0000000000490000-0x000000000049F000-memory.dmp

Filesize
60KB

Download
memory/2180-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2180-2-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2180-43-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2180-64-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2180-88-0x0000000000490000-0x000000000049F000-memory.dmp

Filesize
60KB

Download