f64fce7ee367147db491eca808a57518552fd499a83ce7b74210d2e08e37a0bf

Analysis

max time kernel
139s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a29cead68c695ca13d594a717cc6768a_JaffaCakes118.exe
Size

71KB
MD5

a29cead68c695ca13d594a717cc6768a
SHA1

e90265bf72d0f1939b89d48da281ac95d3600cf7
SHA256

f64fce7ee367147db491eca808a57518552fd499a83ce7b74210d2e08e37a0bf
SHA512

d191dd3078f84707885e8535309b431989caafc4d3e2775e74845c3525bb4287972de2aacd71c448fd630c733b15fd0976f0d7a2caab7d16b8fcedff9aa8c112
SSDEEP

1536:o3lqwIhQJYD5E0j+N3jOlLtiPyWCIjJlGhcnpQm:0lomXUdI7GhQpQm

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	a29cead68c695ca13d594a717cc6768a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2568	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	a29cead68c695ca13d594a717cc6768a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
700	2208	WerFault.exe	83
5028	2568	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a29cead68c695ca13d594a717cc6768a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2568	2208	a29cead68c695ca13d594a717cc6768a_JaffaCakes118.exe	90
PID 2208 wrote to memory of 2568	2208	a29cead68c695ca13d594a717cc6768a_JaffaCakes118.exe	90
PID 2208 wrote to memory of 2568	2208	a29cead68c695ca13d594a717cc6768a_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\a29cead68c695ca13d594a717cc6768a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a29cead68c695ca13d594a717cc6768a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 328
  2⤵
  - Program crash
  PID:700
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 224
    3⤵
    - Program crash
    PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2208 -ip 2208
1⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2568 -ip 2568
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
47KB

MD5
6adfee71403f0b87b5a44b63d0df24ca

SHA1
8d9d50a16aa91b26a2dc811033bc8c2e21df9388

SHA256
8720dd6e3826ff89c55d866013d24e7c8d37ae12d2b5adefbadfc338aa4606a3

SHA512
40dbfe9e81a9cc6d28b2cbdafab89561a068d4d5c01ab721437ca272f4103f022dcc05ddfcc01209a3f9805e6a486406a56ba6b65dc761947455b41f76d93d64

Download Submit