bbd28ba655bcd4d1ec0e0271d9523c801e7d8a5c23ed2ec0868dab6e524f6625

Analysis

max time kernel
135s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2cc1fa5662fcc7435ef4c29e9cab34c_JaffaCakes118.exe
Size

187KB
MD5

a2cc1fa5662fcc7435ef4c29e9cab34c
SHA1

e1bc19f41f12595ac66d2e2ab3d77f3c808de94e
SHA256

bbd28ba655bcd4d1ec0e0271d9523c801e7d8a5c23ed2ec0868dab6e524f6625
SHA512

3dcc731bc693eb89fcf96fd2da230a5b6fd7d4e9fa4f5db36199a0aac7379a3487c379bec54d154a827af4273245868a5e66e3985825fe68383a55c1d9a60f0f
SSDEEP

3072:gbecw8GlS2+646tawgD4zuwhPKUH0wHKtXdApnZ:/lD+646tazDkZUn2

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	a2cc1fa5662fcc7435ef4c29e9cab34c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2cc1fa5662fcc7435ef4c29e9cab34c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3464	a2cc1fa5662fcc7435ef4c29e9cab34c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 3704	3464	a2cc1fa5662fcc7435ef4c29e9cab34c_JaffaCakes118.exe	87
PID 3464 wrote to memory of 3704	3464	a2cc1fa5662fcc7435ef4c29e9cab34c_JaffaCakes118.exe	87
PID 3464 wrote to memory of 3704	3464	a2cc1fa5662fcc7435ef4c29e9cab34c_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\a2cc1fa5662fcc7435ef4c29e9cab34c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2cc1fa5662fcc7435ef4c29e9cab34c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Nsb..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Nsb..bat

Filesize
238B

MD5
414cd9988b5039eb96a0332fdc0f8394

SHA1
284f5c4c1ce986e901373a6909677dbeb5e4984e

SHA256
a5be708371b63b3886777fd55d58822df8c98f3849a0f9c7b6500b1299789b60

SHA512
6db42d64b5028021ff0c849158cf536869d8c438567e7c4148f1b2da89c229b292e79f97f2621ba4d06459b287818a614adcaf8358561b2a4245427812fb0db7

Download Submit
memory/3464-0-0x00000000022A0000-0x00000000022C2000-memory.dmp

Filesize
136KB

Download
memory/3464-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3464-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3464-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3464-5-0x00000000021F0000-0x00000000021F6000-memory.dmp

Filesize
24KB

Download