1a527cb87d5cdbe942e65986f6b2220bb3c4e1286c46c9d2b8b423524276badb

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf98df7515ea85432e237f55eb85991b_JaffaCakes118.exe
Size

272KB
MD5

bf98df7515ea85432e237f55eb85991b
SHA1

e18e193ec2f2bac3c7b7bcd9a61ea26f2e56c37f
SHA256

1a527cb87d5cdbe942e65986f6b2220bb3c4e1286c46c9d2b8b423524276badb
SHA512

66d8356d30cce9e4d433cca40a0a9bd1607526d0ea9a050d3183ced12484007e0a7af66e7c4b89efe0a042957e18e7fe3e11597343a170f6396894922797d698
SSDEEP

3072:YGKROS5fkMLalsplF9YxKROS5fkM05Cn0IKbuFEI1ZCM1PqG9pT632FszuZMrBlj:lKRlfdLQsZ8KRlfd6Cn0IMul2NZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	bf98df7515ea85432e237f55eb85991b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2748	Zehir.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 2748	4540	bf98df7515ea85432e237f55eb85991b_JaffaCakes118.exe	87
PID 4540 wrote to memory of 2748	4540	bf98df7515ea85432e237f55eb85991b_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\bf98df7515ea85432e237f55eb85991b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf98df7515ea85432e237f55eb85991b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Root\Zehir.exe
  "C:\Root\Zehir.exe"
  2⤵
  - Executes dropped EXE
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Root\Zehir.exe

Filesize
74KB

MD5
38cd4584c32790d760d0632d320e4716

SHA1
dc885b4ed344adc0c67f1b827e8d74263f544a06

SHA256
4bc8aa3eea36d5851950ed1b16951ab4b40a191718de3834a78b99794984cf69

SHA512
6353af247f56512e364c3a41b398d87a85432bed2a5a22a92e28a009c175bf58c8e35b5cab7a49537bf9c545ed2468b6510434ea89b02f413a2ff5ee4fefc5bf

Download Submit
memory/2748-26-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/2748-25-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/2748-30-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/2748-21-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/2748-28-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/2748-27-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/2748-24-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/2748-22-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/2748-31-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/2748-29-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/4540-8-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/4540-23-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/4540-7-0x000000001C450000-0x000000001C49C000-memory.dmp

Filesize
304KB

Download
memory/4540-2-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/4540-0-0x00007FFA152A5000-0x00007FFA152A6000-memory.dmp

Filesize
4KB

Download
memory/4540-6-0x00000000011B0000-0x00000000011B8000-memory.dmp

Filesize
32KB

Download
memory/4540-5-0x00007FFA14FF0000-0x00007FFA15991000-memory.dmp

Filesize
9.6MB

Download
memory/4540-4-0x000000001C2F0000-0x000000001C38C000-memory.dmp

Filesize
624KB

Download
memory/4540-3-0x000000001BCE0000-0x000000001C1AE000-memory.dmp

Filesize
4.8MB

Download
memory/4540-1-0x000000001B760000-0x000000001B806000-memory.dmp

Filesize
664KB

Download