2deaac05cdf9d2972a8ad1923fb983e28a26995046965ad3e77c89e6efd7e1b7

Analysis

max time kernel
140s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b5d86c1f82c242b687f4c9db1f72f77b_JaffaCakes118.exe
Size

813KB
MD5

b5d86c1f82c242b687f4c9db1f72f77b
SHA1

be2787fc77cc4683496e8d9e8b314f3f52378592
SHA256

2deaac05cdf9d2972a8ad1923fb983e28a26995046965ad3e77c89e6efd7e1b7
SHA512

0323c8174cd673f2d730b737c9c90afcc008ac890e05098631368dad477d36126a6609ebbcb1a919a2c489d5e557f93125a6ea5012bbdaa83e377333fca5ff40
SSDEEP

12288:U5OeZeDuUlOeDuUl54/md1ykj4g1AkKQAKfj0OCVr9hOHaKJlNrr+:UIK5e4014g1AkKAnCVr3O6KJzS

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	b5d86c1f82c242b687f4c9db1f72f77b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1764	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5d86c1f82c242b687f4c9db1f72f77b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1764	4796	b5d86c1f82c242b687f4c9db1f72f77b_JaffaCakes118.exe	87
PID 4796 wrote to memory of 1764	4796	b5d86c1f82c242b687f4c9db1f72f77b_JaffaCakes118.exe	87
PID 4796 wrote to memory of 1764	4796	b5d86c1f82c242b687f4c9db1f72f77b_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\b5d86c1f82c242b687f4c9db1f72f77b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b5d86c1f82c242b687f4c9db1f72f77b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer.exe

Filesize
70KB

MD5
0e680501850cb30cfc83d8b7434bf2c7

SHA1
d07a8bfed87636bd991cf216d3efeeb6ee61bcea

SHA256
4ee117fbea8714d85e489ccaf30327cc4551f9d7d8fa2366c039fe07e3481f9b

SHA512
6e28c888a14028e97d019f45ce3b2c6a457343b3398bd7ddc28bf31a7c117d28f94a89dcc41e4bf71f797dd63ac48ed69118208cc9c079939731965c7c0e1c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\properties.xml

Filesize
4KB

MD5
4d5810ea7c81fceb5e267f3b4693001e

SHA1
f0ee097954be56b9316195b1cbb8cc5655c07d06

SHA256
20298810925b46afb9b87f32559b249b9333835db79f4499aa7ba1266d8935c0

SHA512
1e4a63ddedb85352d0ac32fe586f52e41df17900a7efff66663f3019cee596ddeef127c105abc987e0b42a83a593f85cc384075c4a5295b1f11202bd60900538

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\step0.png

Filesize
17KB

MD5
ca2d51b3144a8254aaeed62ba2a7c3d7

SHA1
a6d1ccfc4b21ef4f524e1dae4ac219f5fcca25ad

SHA256
9877822b61e8b41ef24cecd86103b04fcd995d2bd785a4fe59bde7aecf0a87dd

SHA512
5852b3ec7066d8c2018fb2a345273f5b43ad8e113736877b9b9e5497b7c526e6799777f62fa5e6f22c3f8a4774203671b8b12ca6834c519e20d9d978a4b515b2

Download Submit
memory/1764-26-0x00000000737C2000-0x00000000737C3000-memory.dmp

Filesize
4KB

Download
memory/1764-27-0x00000000737C0000-0x0000000073D71000-memory.dmp

Filesize
5.7MB

Download
memory/1764-28-0x00000000737C0000-0x0000000073D71000-memory.dmp

Filesize
5.7MB

Download
memory/1764-30-0x00000000737C0000-0x0000000073D71000-memory.dmp

Filesize
5.7MB

Download
memory/1764-32-0x00000000737C0000-0x0000000073D71000-memory.dmp

Filesize
5.7MB

Download
memory/1764-33-0x00000000737C2000-0x00000000737C3000-memory.dmp

Filesize
4KB

Download
memory/1764-34-0x00000000737C0000-0x0000000073D71000-memory.dmp

Filesize
5.7MB

Download
memory/4796-35-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download