eb880c6aa541a6cbc53739699367b9cdbd986bf5516d36d7ce287cb5b351b099

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc50ddaa2509805a3a449834deeefca0_JaffaCakes118.exe
Size

523KB
MD5

bc50ddaa2509805a3a449834deeefca0
SHA1

cf1ac10d2088e91fe80bd397a988c0c9c8054128
SHA256

eb880c6aa541a6cbc53739699367b9cdbd986bf5516d36d7ce287cb5b351b099
SHA512

0715dcb4e30002acb83a1643d9d64d7702cfc613f5935006033caedb228eb3446fa213c7545c2e8a95feedb8b339d03eced461f9f80c6da48476ab2879fad65f
SSDEEP

12288:53JCFkQWTfpoiwongqTBTgRb7J3AYciPybR6lVJ9PtnLhk6rL:53JCJOfWl/czRirtnLf/

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	bc50ddaa2509805a3a449834deeefca0_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1908	firefox..exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc50ddaa2509805a3a449834deeefca0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	firefox..exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 1908	4036	bc50ddaa2509805a3a449834deeefca0_JaffaCakes118.exe	91
PID 4036 wrote to memory of 1908	4036	bc50ddaa2509805a3a449834deeefca0_JaffaCakes118.exe	91
PID 4036 wrote to memory of 1908	4036	bc50ddaa2509805a3a449834deeefca0_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\bc50ddaa2509805a3a449834deeefca0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc50ddaa2509805a3a449834deeefca0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Users\Admin\AppData\Local\Temp\firefox..exe
  "C:\Users\Admin\AppData\Local\Temp\firefox..exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4128,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\firefox..exe

Filesize
507KB

MD5
11e90f713db883b9aaab428ae1525e12

SHA1
5f388346fe694d0cad33805ed6ab38c5cbe5f7d5

SHA256
7fa39696c982da8162c0a7b0f7d7b59255c02fd26cadb6cf5dda40a4b5498322

SHA512
197e2312e0a252a910793d6db915884eb9512f4392c814c51b403e50c82451b695807e3fad12460290cd2e8664f2a7534db4245a1449a30d819c094c66b5f674

Download Submit
memory/1908-165-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-72-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-196-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-40-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-227-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-103-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-134-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-258-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-41-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1908-9-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1908-441-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-289-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-320-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-351-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-379-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1908-410-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4036-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download