30e8d378f05fe57e00b235782954cde29841b123d7df1e4f17a2f93506e38908

Analysis

max time kernel
134s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

badb9150e2d8391f49c55f0c8129606a_JaffaCakes118.exe
Size

318KB
MD5

badb9150e2d8391f49c55f0c8129606a
SHA1

46de4ab5274ccfa458863454083955a77c83e3e5
SHA256

30e8d378f05fe57e00b235782954cde29841b123d7df1e4f17a2f93506e38908
SHA512

e3f1f4574d512ab08b2b3cdd72cc9cd7055970df718a816c709eb8cafa37036f1f857aee293a78b7e29111bf14bc549c756476dca76bfe2964e6b8bda896390c
SSDEEP

6144:uSB1Ed0h/CB5OVhc9kkE+rS97AJPPhw4DSmJlvzFsL9hxqCzQw/2kn+Op6SbjKXr:u81Ed0hYcVhu+ADw4D5lvzFsL9zcM+Rd

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	badb9150e2d8391f49c55f0c8129606a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1724	FFCImage.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	badb9150e2d8391f49c55f0c8129606a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFCImage.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 1724	3652	badb9150e2d8391f49c55f0c8129606a_JaffaCakes118.exe	86
PID 3652 wrote to memory of 1724	3652	badb9150e2d8391f49c55f0c8129606a_JaffaCakes118.exe	86
PID 3652 wrote to memory of 1724	3652	badb9150e2d8391f49c55f0c8129606a_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\badb9150e2d8391f49c55f0c8129606a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\badb9150e2d8391f49c55f0c8129606a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Users\Admin\AppData\Local\Temp\FFCImage.exe
  "C:\Users\Admin\AppData\Local\Temp\FFCImage.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FFCImage.exe

Filesize
547KB

MD5
2cab35d2382aeae9634c32f9f9fc5ab9

SHA1
31587a0bd08753d640c7a6c2097005ace6a36c70

SHA256
33ecb1fc3f031b23c80c9bc3e5bd7cb758765f6ca31f250341b99dcc414d90e9

SHA512
81e58a1c0947ab87c536d0514f3cdae0d4d0cf0a304cada5d7a299f792676734be5d7d30c899d0061349cfc241cf174d6d77801c6b1db69f59ec0ddb157ed031

Download Submit
C:\xs1092.txt

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
memory/1724-11-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1724-18-0x0000000000020000-0x00000000000AE000-memory.dmp

Filesize
568KB

Download