e3aa72756076d0a45c16ccbd77271f36d1ac822a2af5b272220217dbe5876d6c

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a4252564e040178f6bf6e3c4d3d77ef2_JaffaCakes118.exe
Size

104KB
MD5

a4252564e040178f6bf6e3c4d3d77ef2
SHA1

5414c901ebc74bf55ab6a37f459fba5adfb9a18c
SHA256

e3aa72756076d0a45c16ccbd77271f36d1ac822a2af5b272220217dbe5876d6c
SHA512

ed45f581826912e5b67de0f698c46d29886bc8243a610f42690a8403438b6676e888afe93a61594b1a00e51023173ecb87e01866ae51c76e0ab71a9e89f53d8d
SSDEEP

768:qzwe9kjCsqnuSg0+KBIN+X5zGyGZ3MQWfLagoDEcLqgIjbKkTte1:UOCsPU+CJz7WZWGgoOgYbPBe

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	a4252564e040178f6bf6e3c4d3d77ef2_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3264	eToroSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3880	3264	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4252564e040178f6bf6e3c4d3d77ef2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eToroSetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3264	4436	a4252564e040178f6bf6e3c4d3d77ef2_JaffaCakes118.exe	84
PID 4436 wrote to memory of 3264	4436	a4252564e040178f6bf6e3c4d3d77ef2_JaffaCakes118.exe	84
PID 4436 wrote to memory of 3264	4436	a4252564e040178f6bf6e3c4d3d77ef2_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\a4252564e040178f6bf6e3c4d3d77ef2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4252564e040178f6bf6e3c4d3d77ef2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\Temp\eToroSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\eToroSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1972
    3⤵
    - Program crash
    PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3264 -ip 3264
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eToroSetup.exe

Filesize
72KB

MD5
554671db339598e1b965adac5d2491a6

SHA1
108297121db85d9ee0bffbc71ba96bd1abe4f9f1

SHA256
0c7b2779dbfaf71709b40114b756ae37cd0e071d313a1adaa4fb4b45033d757d

SHA512
d466af3f4250d3788f880c95d44bdd454045dc93dc6d96fe849edd481dcf6b0f6f45f2c4c1d781cd3d38e9a5babc5dcac1fcc9450018a47bf40ec3c1e1b7b18c

Download Submit
C:\Users\Admin\AppData\Local\Temp\etoro.EXE

Filesize
215KB

MD5
9cf410cfcc18cfda96ee1268bddbc504

SHA1
eb85470164a42ae78b7c5da8099011cd4b2835ec

SHA256
57321155eba19b10d9b0a4665998a996fee24f21eb9059501f84acb67d942412

SHA512
32749b594bf7261167e84ed9b379d861489c9586b1af9e57ee05893f9f6daadcc00724b79ba061dfdb2bf2586ac73bf178918c695f82e9c2dca2890723f8ba85

Download Submit
memory/4436-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4436-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download