b29516fa8711c1c941b5f0f759d32524726ba7fec056a0661de649d16a011f35

Analysis

max time kernel
131s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe
Size

112KB
MD5

d1abcc8f626d678e2c60c26b138d569d
SHA1

4a64952a9b02dfded8b0858cf4e90fe9d87d6962
SHA256

b29516fa8711c1c941b5f0f759d32524726ba7fec056a0661de649d16a011f35
SHA512

32ee75e85fa65a359ef3b98869eb58bc229d40cdbb866e5e09c37c804e34fbc9a1e2a4103d6f74165033baa3aaa9fada6b8811f967548163bfbefd1b6b2f26ab
SSDEEP

3072:Sp6C7gJyCpctk7LDb0CXiVnHvU1eTJ0ZP:W658uctez0CXiVnHv6OJ05

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4408	elite.exe
4304	Elite-Assassins Elite-Cracker By Rocc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3608	4408	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elite-Assassins Elite-Cracker By Rocc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4500	d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe
4304	Elite-Assassins Elite-Cracker By Rocc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4408	4500	d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe	92
PID 4500 wrote to memory of 4408	4500	d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe	92
PID 4500 wrote to memory of 4408	4500	d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe	92
PID 4500 wrote to memory of 4304	4500	d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe	93
PID 4500 wrote to memory of 4304	4500	d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe	93
PID 4500 wrote to memory of 4304	4500	d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d1abcc8f626d678e2c60c26b138d569d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\elite.exe
  "C:\Users\Admin\AppData\Local\Temp\elite.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 496
    3⤵
    - Program crash
    PID:3608
- C:\Users\Admin\AppData\Local\Temp\Elite-Assassins Elite-Cracker By Rocc.exe
  "C:\Users\Admin\AppData\Local\Temp\Elite-Assassins Elite-Cracker By Rocc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4408 -ip 4408
1⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1420,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Elite-Assassins Elite-Cracker By Rocc.exe

Filesize
80KB

MD5
0531e13a4ee83b0794590ad5b73d8edf

SHA1
1b1b5305ea0901046fa73d7efb5e337f6aff4db9

SHA256
a17f6239b9dcf5bf85e97a843f7470031936c30e5e1f4698f6bc040e45c4cbf2

SHA512
fb51c7c17e7f16fb681f9d3ec2d9283a3683ddf48006d625b52c0144df556cfbfe5bd3e41120e4fd45a800144aecd9549d0fa1944421a219f43c6ef473210e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\elite.exe

Filesize
8KB

MD5
9fdd217cbcf290b558a3182e12977527

SHA1
11b0a0997779133a8f36c886c8b688c61dfe684d

SHA256
c692c0f6749399fb37428e9189cd52f28b28aa2f89f404f8ecfdfe023658014c

SHA512
7c4a8f7e3f9dae7e210e587246533ccf184f667f9bd96ad107a32c56616321a18c564271fb45d79b1fddb7da01d5a61da7f996f427ec7047c863f2ebc82359f3

Download Submit