7054942fbb1ddac0dfeb303d8838f455500077093a49677677b43d115e96be13

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe
Size

131KB
MD5

b12b3cf3931da7bb6306289e16817c95
SHA1

d83fa51a17db52ef129a6aa850815a8c97c0fc6b
SHA256

7054942fbb1ddac0dfeb303d8838f455500077093a49677677b43d115e96be13
SHA512

76798e133e66ddc1b75b316769bb26013698398891dcd1c4fcf5783f0a6e87b1847f36d0e7264f981071a86ef27e9ab6482c89f8836405d11783dbd0a989dfb7
SSDEEP

3072:sYP2XerzhOUxu/XUtauYp5pNhqkBRfk0/FgXac:su2urzh9xu/XkauY3pjJFc

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2764	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe
File opened for modification	C:\Windows\NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240620406	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	2764	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 2764	4312	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe	93
PID 4312 wrote to memory of 2764	4312	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe	93
PID 4312 wrote to memory of 2764	4312	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312
- C:\WINDOWS\NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
  "C:\WINDOWS\NEPAL-YAHOO NCC CRACKER BY USTAD1.exe"
  2⤵
  - Executes dropped EXE
  PID:2764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 216
    3⤵
    - Program crash
    PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2764 -ip 2764
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\NEPAL-YAHOO NCC CRACKER BY USTAD1.exe

Filesize
44KB

MD5
40d7f8db372e81e98e0df76a1268ba64

SHA1
c0e5f4b512237a1e006c7dc96d52a632f690cd31

SHA256
246e31661020a19749fcc13c38866bb9393ac0c5faeb6864a452596b9b122032

SHA512
8f8a2965f3c39c469382996039b0324070dec1f21d133199783e04b45eec2dc32c3a3126c03c61ec5491461920e8e44c9ca59b415d07709c81fb3e54ff37c454

Download Submit
memory/2764-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download