Analysis
-
max time kernel
94s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08-09-2024 10:07
General
-
Target
d41cee70cac085a607fd2cb9ee801fcc_JaffaCakes118.vbs
-
Size
749B
-
MD5
d41cee70cac085a607fd2cb9ee801fcc
-
SHA1
de7f92a36942473bd9b861188a8cbe9a62906bbb
-
SHA256
ed56db3bff8fc61fb92ab10d42e227b0f16d95729feb43f17a660454de4851ab
-
SHA512
064ed90bf902d61fad5dc4f423a32c785395a3d8dd985df3e8d866d293fe5e93e44b38b01f90ba5c6104180ca44e2eeb3e4de6eeba8c1a40e4ea412d39d3d778
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d41cee70cac085a607fd2cb9ee801fcc_JaffaCakes118.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
-