27e2378a2b471c8e8db085b978ceffaf3e2e449e5c15c72a7fa27a9fa9c0c746

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

941b7fcb72745724a050351afc99d725_JaffaCakes118.exe
Size

29KB
MD5

941b7fcb72745724a050351afc99d725
SHA1

b72a4b79fb69e8a547f59d2f9b126282056692ab
SHA256

27e2378a2b471c8e8db085b978ceffaf3e2e449e5c15c72a7fa27a9fa9c0c746
SHA512

4033285fbd3f40692246bdb9da6cdef802d33dc5916297bb72b711d564d0d2a27dbcd4bc4067a6ee1e4182cce84ab4d8a6c7aaac9ba15455806a488a145d7688
SSDEEP

768:KN6Vi83Fj/qiATJ0+5SSqkjzEfZl2xnYdEp2:K8VifJkMjxxQE

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5104-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/5104-10-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nskhelper2.sys	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe
5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe
5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe
5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1292	5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	91
PID 5104 wrote to memory of 1292	5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	91
PID 5104 wrote to memory of 1292	5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	91
PID 5104 wrote to memory of 3028	5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	93
PID 5104 wrote to memory of 3028	5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	93
PID 5104 wrote to memory of 3028	5104	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\941b7fcb72745724a050351afc99d725_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\941b7fcb72745724a050351afc99d725_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240622000.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240622000.bat

Filesize
269B

MD5
f5183aa0cdae87f2e5388b69d1c42528

SHA1
bfe827ab42677b78f13be199592c96aec18671ed

SHA256
a505529ab29274da43813fe89bc5a7ef74bc072cd24bad57c7d6b752d5e991c9

SHA512
ffa4854b1a98cf21ed44ad1f6cac07ca6e0fd2c94bbcb5c9c7f84d4d5c56d618c8b8647ffcefa28114483d3ce913453f71451b6c46822d8d9ee0f241bf1dd85f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll953.dll

Filesize
49KB

MD5
90efb0d7e60224e65a220e820ad87e50

SHA1
2d2c91de7d598ca3f970e02f62beaeb3f7069af5

SHA256
e5de4edf2afffafbc9e1a3ac32f5f159e9583ba08bc645bd55eece1f6df388a0

SHA512
ee12303ab112c1d079633004c86cdd1c0a1a0aebcce4081c79a185bb1569f6169933e37f858dcecbd05e6155a18d5d776d0c675e5b52a5b01b4cdcc696a6435b

Download Submit
memory/5104-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5104-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download