f9d5e40276d4ce6dd36397bb67056842e866a5654616610b2198133e46ca6c0a

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe
Size

90KB
MD5

cf1385e6230b67fad8021b96787891e2
SHA1

e0caaaf052092676d0d948e0ff3c682ff170128b
SHA256

f9d5e40276d4ce6dd36397bb67056842e866a5654616610b2198133e46ca6c0a
SHA512

e6c244ed6ad42da9636c76c6487b5d4b2cd59cdbbc232ca068e920f6021542478bc132eaca3479d4397bbf4ca448cb09818949ef5f2746dd2b01f64ce9e07103
SSDEEP

1536:i1dtGmlhGdz2IacJa3u9dfOv919D2AzKUvhWRx0q0cnfRCGRlfXVAG80x5gcR4+t:i1dtGmlhGh2I43ubOvXt2I4Kq0cnjRlv

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3080	3548	cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe	88
PID 3548 wrote to memory of 3080	3548	cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe	88
PID 3548 wrote to memory of 3080	3548	cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cf1385e6230b67fad8021b96787891e2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Fgv..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Fgv..bat

Filesize
238B

MD5
e8f7c27273bab8a43794715ec03339f4

SHA1
3d56b5f948cfa1c1260cb9fc3b71aca2963a84ae

SHA256
3c6a03ebec50db061e0b64763ef379925d091624566c8da32c8f5ff0914a989e

SHA512
f34d56fd1846727cfc61249366a30c5067608fe551cebe4117c333e8ec45a7f00c8dc173fb404997d5dbd427d11140b80ec5952bae8571042762339416f1d653

Download Submit
memory/3548-0-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/3548-1-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3548-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3548-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3548-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download