a08dc439f87a1417472ba2a2d5248bc7d1784ad312cedec025ece713adb37847

Analysis

max time kernel
129s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 19:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe
Size

80KB
MD5

c171abbb15ded16a9bfb09ed5c53f78c
SHA1

d357bf4eeda19d2e1cdb15cb1594dfa3c55f750a
SHA256

a08dc439f87a1417472ba2a2d5248bc7d1784ad312cedec025ece713adb37847
SHA512

3175ccc31c1e87d818d17f39e01c06959ae237220498754fee564c237e14d683d0bf5f0d9de926aef9df865e03c11c9031ab8601faa7bd3b55fe1eba3488cf9c
SSDEEP

1536:hbhbAmm8x0UD3JxXjd+gQQ5P7foeKqzXZKIJr/OIBZWLZ9tW342zpH0GtDFn:Rhbbx3jPTdHtpOq9KI5mIPW4I2zrDFn

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1492	ddel240627234.exe

Executes dropped EXE 1 IoCs

pid	Process
1492	ddel240627234.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\myAddr.dat	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\1445450.dll	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddel240627234.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3036	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe
3036	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe
3036	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe
3036	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1492	3036	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe	84
PID 3036 wrote to memory of 1492	3036	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe	84
PID 3036 wrote to memory of 1492	3036	c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\ddel240627234.exe
  "C:\Users\Admin\AppData\Local\Temp\ddel240627234.exe" C:\Users\Admin\AppData\Local\Temp\c171abbb15ded16a9bfb09ed5c53f78c_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ddel240627234.exe

Filesize
10KB

MD5
1b8b8d267472cdd58de3ae090ca6ad36

SHA1
526016dd7898ffaf021ed37eb2c973955bf8b96a

SHA256
c38a693b51e15934e1c90b63aabaa312eaf375481ac91d0615efe6e65e590e53

SHA512
1c8c4e6e103176e3c8b001c979c338e1e7b4007a26d0b5448c42e6d88b7c15828b9f43d49eb77ea61244c2e2112d59f528bd6435cb4a0cd0b56d4cbcc3360b11

Download Submit