41e0e7c2ee6ddbd98985f9f1385ab89e82017886d2ddf796556c7a311d0856e6

Analysis

max time kernel
96s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d30d476c6e8b9af349adbd1bfc63a698_JaffaCakes118.exe
Size

109KB
MD5

d30d476c6e8b9af349adbd1bfc63a698
SHA1

4574bbb7b4e12688748d735a47e22fb642fd9c5f
SHA256

41e0e7c2ee6ddbd98985f9f1385ab89e82017886d2ddf796556c7a311d0856e6
SHA512

4aafe7cff174f1764bdefc92810fa9f80f8b972e772cb3e722943a984450933bbc815d33436303156fe014a54392c31e545b5e101aefc6e57fdd2804cacf8a76
SSDEEP

3072:5si+XmpcDI5ba6jiH3gVc614JTq4i0lkYo2OEwwSW5D5VFIb:Gej1x14J2UkT2OEHk

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	d30d476c6e8b9af349adbd1bfc63a698_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d30d476c6e8b9af349adbd1bfc63a698_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	d30d476c6e8b9af349adbd1bfc63a698_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3948	1564	d30d476c6e8b9af349adbd1bfc63a698_JaffaCakes118.exe	86
PID 1564 wrote to memory of 3948	1564	d30d476c6e8b9af349adbd1bfc63a698_JaffaCakes118.exe	86
PID 1564 wrote to memory of 3948	1564	d30d476c6e8b9af349adbd1bfc63a698_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\d30d476c6e8b9af349adbd1bfc63a698_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d30d476c6e8b9af349adbd1bfc63a698_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Brv..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Brv..bat

Filesize
238B

MD5
3775cfe5c7b1d53c1ca9e851be33c916

SHA1
e4aacd272ec4b53c3a1a289c36e4345fafa6580a

SHA256
191d3ea4d1b05c7dea6424f751d5fe06e4de83cb93c2f00afe522854752cd598

SHA512
2ffed87ca6a42028a03cc23873dd48515062fc1e1af7ca783362cb7f17ff888f77be41cd0d849fcc5c373eb703fcea043bf676e4fb6d7a9e3827444c6d5b3b27

Download Submit
memory/1564-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1564-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1564-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1564-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1564-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads