c96098f7a8c67a8e53e38f84231122c09efcb03268afa4b1632a5d77b36168b5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abb9c6da1659ac4eb2cc9de483a5b31d_JaffaCakes118.exe
Size

3KB
MD5

abb9c6da1659ac4eb2cc9de483a5b31d
SHA1

972865b2d970e038741b23e6dc40c7c60689fed6
SHA256

c96098f7a8c67a8e53e38f84231122c09efcb03268afa4b1632a5d77b36168b5
SHA512

b2d4939b8a038abdbcc2e64ea9c68d187962bb90c71a43e51038bc0ac3e66a00f961a538486ddc711e46e7ee78799fd962b30308aca55da900fa2c7f5d33102f

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	abb9c6da1659ac4eb2cc9de483a5b31d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abb9c6da1659ac4eb2cc9de483a5b31d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\abb9c6da1659ac4eb2cc9de483a5b31d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\abb9c6da1659ac4eb2cc9de483a5b31d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
1KB

MD5
679099d4a5707f6bb1ab37cbb2bd4083

SHA1
596d4fdf30b23dff4b2bd3a23ab12d548464854f

SHA256
d301a78c211039c0fc59ae38f33529475fced6e8dae1e43517bebb745b8ac73a

SHA512
1dca279ecc613ecfd7076a17b5b57883b746a28a04d65739a267290577f1092d231a248584ebf3ce690993d0bf7731129276182c88e44b8e033ed59d13f89c97

Download Submit
memory/2836-12-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download