d5eef3dda5a709e155a92907e47e03f7e0071fc8b106d1675054d2bdb3ccadfb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8a884e5bdb0d1b32a5cdbd3e55d8a08_JaffaCakes118.exe
Size

78KB
MD5

c8a884e5bdb0d1b32a5cdbd3e55d8a08
SHA1

c922f445374c039a80a54afbe613a147b1e79499
SHA256

d5eef3dda5a709e155a92907e47e03f7e0071fc8b106d1675054d2bdb3ccadfb
SHA512

8ffab0c6184defe57c6af9f6c30159d3fe36ad4dc1a6d99135848c4f7ee0a718f7abaef2c650a47f7cf2986dafaa5ba05ab8ee2146655b9f708e5b65973d8bda
SSDEEP

1536:6em69S/uuKfi0j604vPpCW+UsS8aZzyp0G2Ym/sENNbZmrVv5wxqdeAeDX8yBtJq:N9f4W0GE08y8zAi8yBCvLoFJj9Z1rSB

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	c8a884e5bdb0d1b32a5cdbd3e55d8a08_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8a884e5bdb0d1b32a5cdbd3e55d8a08_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 760	1168	c8a884e5bdb0d1b32a5cdbd3e55d8a08_JaffaCakes118.exe	88
PID 1168 wrote to memory of 760	1168	c8a884e5bdb0d1b32a5cdbd3e55d8a08_JaffaCakes118.exe	88
PID 1168 wrote to memory of 760	1168	c8a884e5bdb0d1b32a5cdbd3e55d8a08_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\c8a884e5bdb0d1b32a5cdbd3e55d8a08_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c8a884e5bdb0d1b32a5cdbd3e55d8a08_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ulv..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ulv..bat

Filesize
238B

MD5
1414ea9a64478de460276ec5f97e4823

SHA1
392f5c2be88f2f2d25dd881615d2af8b0ceedd79

SHA256
824e0a2a3a1656fd23d10076e5b3cbdb94646a5f7f94c93aa3d2bd7608df0dc9

SHA512
f7a8115bc477ef64e277ebfef1d7024af9340d20195612834c9f7bd91639b22d5251bdaa556471c1848dc3a5078fe0d56e9e162cef4f5771eb22288ba71a5ff0

Download Submit
memory/1168-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1168-1-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1168-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1168-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1168-6-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download