9fcc69bbd09d12dd9e083399a5eaa0cfd1fa913495b93ac5cf79746ab29fb696

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
Size

23KB
MD5

be911940cfa1e6e61e351673e04e87fa
SHA1

63ba7d27c0ddf0a5ec74227dc43d4eff05f5c46b
SHA256

9fcc69bbd09d12dd9e083399a5eaa0cfd1fa913495b93ac5cf79746ab29fb696
SHA512

cdff5c4dd1d64877fed048c0a157dc796b5a9006c94cb3a7cc6acb9bc55e120c273880ecd4e3cf124af4c36b50564d28e971996f4816869c91d92a8a5eb9795a
SSDEEP

384:+2F7GPfJnG3ZlQjQmjJSpzB+gujxqR9lHmzTGf8r:+2F7afJQzB+guMjQzTGf6

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
224	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4544	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
224	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 224	4544	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	87
PID 4544 wrote to memory of 224	4544	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	87
PID 4544 wrote to memory of 224	4544	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	87
PID 4544 wrote to memory of 1552	4544	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	94
PID 4544 wrote to memory of 1552	4544	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	94
PID 4544 wrote to memory of 1552	4544	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	94
PID 224 wrote to memory of 3044	224	svchost.exe	98
PID 224 wrote to memory of 3044	224	svchost.exe	98
PID 224 wrote to memory of 3044	224	svchost.exe	98

C:\Users\Admin\AppData\Local\Temp\be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\svchost.exe
  "C:\Users\Admin\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\309.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8648.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\309.bat

Filesize
515B

MD5
2e1bc1220f187ab8edabc98c65ae240a

SHA1
ded2b51043e6237466808d5bdfd324a98dc7b34e

SHA256
de6de4772b31f21c07db9d50eb4b4fa2108137dac171f1bde6bcbce733660bb3

SHA512
ae90f87d9ac7147d91c3326b96d7471d12fdba4c84b91fbf79ad01ab34a744f6ed8247aa22a48ac42ec3e7ea4b58dc53168c2c99a83d48f067e2bcee88004309

Download Submit
C:\Users\Admin\AppData\Local\Temp\8648.bat

Filesize
153B

MD5
4a477b8df64c3147cca417f2880d337d

SHA1
544bad720edd1905c5621aea671433121fba2c85

SHA256
a6c2c904c6c191b4f84625a0b4d9acd4181cd64bbdf3fc861cba593fd3949d11

SHA512
4f685fc3480b8802b431e147ec35d31f07460101f3249ac47e6954bd2dcc0baa78ac435247139c9829661e0113958dbcf02c2b2e97019015712362423148c06a

Download Submit
C:\Users\Admin\msconfig.exe

Filesize
128B

MD5
f09f35a5637839458e462e6350ecbce4

SHA1
0ae4f711ef5d6e9d26c611fd2c8c8ac45ecbf9e7

SHA256
38723a2e5e8a17aa7950dc008209944e898f69a7bd10a23c839d341e935fd5ca

SHA512
ab942f526272e456ed68a979f50202905ca903a141ed98443567b11ef0bf25a552d639051a01be58558122c58e3de07d749ee59ded36acf0c55cd91924d6ba11

Download Submit
C:\Users\Admin\svchost.exe

Filesize
23KB

MD5
be911940cfa1e6e61e351673e04e87fa

SHA1
63ba7d27c0ddf0a5ec74227dc43d4eff05f5c46b

SHA256
9fcc69bbd09d12dd9e083399a5eaa0cfd1fa913495b93ac5cf79746ab29fb696

SHA512
cdff5c4dd1d64877fed048c0a157dc796b5a9006c94cb3a7cc6acb9bc55e120c273880ecd4e3cf124af4c36b50564d28e971996f4816869c91d92a8a5eb9795a

Download Submit