6f3a9954bc4c9fb890ffc64a3f7b2477d2d0e6fd90247e65c8a9aeefd23d4dc0

Analysis

max time kernel
141s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe
Size

3.5MB
MD5

acb17800c5aef5f6b164061d086bb9d6
SHA1

7e61fa519015856d37bec3e887719a21bbf31dee
SHA256

6f3a9954bc4c9fb890ffc64a3f7b2477d2d0e6fd90247e65c8a9aeefd23d4dc0
SHA512

ac9f8b31fdc7ddd9e4ce0734ae443b9b6d56c47c434b5713e36deb67da6467087946bc3abacd0fbf77af54f2592d00f215b962e1d94c245b45b8c191c50595ce
SSDEEP

98304:dFWVtifrnekQTYTBT5t+md9cC1dbTT2T+ewtvvUCQPSSX:bKASUlT5t+md+i1TTswtHIn

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft TeleSystem.lnk	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2772	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2772	svchost.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\svchost.exe	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe
File created	C:\Program Files\__tmp_rar_sfx_access_check_240614718	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe
File created	C:\Program Files\php5ts.dll	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe
File opened for modification	C:\Program Files\php5ts.dll	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe
File created	C:\Program Files\svchost.exe	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 2772	3092	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe	88
PID 3092 wrote to memory of 2772	3092	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe	88
PID 3092 wrote to memory of 2772	3092	acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\acb17800c5aef5f6b164061d086bb9d6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files\svchost.exe
  "C:\Program Files\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\php5ts.dll

Filesize
6.5MB

MD5
c9aff68f6673fae7580527e8c76805b6

SHA1
bb62cc1db82cfe07a8c08a36446569dfc9c76d10

SHA256
9b2c8b8c4cec301c4303f58ca4e8b261d516f10feb24573b092dfccc263baea4

SHA512
c7836f46e535046562046fdd8d3264cd712a78c0f41eab152c88ea91b17d34f000e2387ded7e9e7b3410332354aabf8ca7d37729eb68e46ab5ce58936e63ac56

Download Submit
C:\Program Files\svchost.exe

Filesize
2.4MB

MD5
4d2a3cb61d692b5ee8f32b4f5f76b693

SHA1
c22f8c6708e62ec33c3c66f72af3cbb613c6a4c9

SHA256
8e474ea3a39eec1e7d3476f42f01a629ea88c7c084d4b97d9ef536ff7e8730d1

SHA512
6de09c17bfefb334b32752c0e23dcb0cd25aff7f0b302f756fe050d1bba20ee0594f931271c689121021a230dab706da0e7512054a8d24084b56526be1c899ba

Download Submit
memory/2772-17-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/2772-23-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/2772-22-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download