7b9f27bff5893c0cf9cb9ae2cb195ad9adcfbcf9e95ce3031a06761fa15e9f78

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe
Size

317KB
MD5

dc167e536e548fedd5671b8b9dcac536
SHA1

2d22423d5eca4d0be0da8acbee906126b8216e66
SHA256

7b9f27bff5893c0cf9cb9ae2cb195ad9adcfbcf9e95ce3031a06761fa15e9f78
SHA512

d06c6ec4319e91e8afbbaf4e288d627739415d665e5aacc4eca4e4b3581f88abc7f578acb0b1e65f9283e97d4260b059577c3bd3da7e8d20824fea52623bf3be
SSDEEP

6144:+0YjywDhq1doBLbii5bkgVuN+xSKV7Wkrsf7LsOSfXVB8KC9b9:+0AywDhwdiXikbkgaISKVJXv8z95

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2076	ACFEB1DF-5926-4B62-AB80-BF84B853CBD3.exe

Loads dropped DLL 1 IoCs

pid	Process
4788	dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ACFEB1DF-5926-4B62-AB80-BF84B853CBD3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 2076	4788	dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe	83
PID 4788 wrote to memory of 2076	4788	dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe	83
PID 4788 wrote to memory of 2076	4788	dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe	83
PID 4788 wrote to memory of 3016	4788	dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe	88
PID 4788 wrote to memory of 3016	4788	dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe	88
PID 4788 wrote to memory of 3016	4788	dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc167e536e548fedd5671b8b9dcac536_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\2b99f21a-7ec0-4134-b604-68b1560374b1\ACFEB1DF-5926-4B62-AB80-BF84B853CBD3.exe
  "C:\Users\Admin\AppData\Local\Temp\2b99f21a-7ec0-4134-b604-68b1560374b1\ACFEB1DF-5926-4B62-AB80-BF84B853CBD3.exe" -y -p30C57DBF-B95B-41E3-AC15-6157AD2482D4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2076
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\2b99f21a-7ec0-4134-b604-68b1560374b1\start.hta
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2b99f21a-7ec0-4134-b604-68b1560374b1\ACFEB1DF-5926-4B62-AB80-BF84B853CBD3.exe

Filesize
204KB

MD5
a1a843901ee01d5c31a928348389fc07

SHA1
f76866220943028a927b8dc8f54620cb0dd41f2e

SHA256
1b81876a2bc0a704a290d120a9c7602242458ae0ca1ddf7e07035795acd46357

SHA512
aa24002104e9f064fa23da297989b0187ec2e79661e2d80a29f244d727c7ebbce9b44d46f966d84edae2fb64b6d25a4d1f968ab8c0e65a578a09b1915d5f963a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2b99f21a-7ec0-4134-b604-68b1560374b1\helper76978.dll

Filesize
122KB

MD5
b3a99f2a72af563cf6dd5f46a55d162f

SHA1
b89a64ed854d6cd18b81f4d5e084915037ec83b9

SHA256
e8176dcf60d23548af81ed56a7772c0901eb4f962d7921ad8a0e99741e2b97c0

SHA512
0fdf9e259fc9581e3add9b852d8ff2d12f1e583576bef9c449645e3b5ecf1ec8cccb1771ccb9afb569dbbd61d122c2b2db7d71cc2c2de298234915ca6a5bd578

Download Submit
C:\Users\Admin\AppData\Local\Temp\2b99f21a-7ec0-4134-b604-68b1560374b1\loader.gif

Filesize
1KB

MD5
e88ebd85dd56110ac6ea93fe0922988e

SHA1
684a31d864d33ff736234c41ac4e8d2c7f90d5ae

SHA256
379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

SHA512
211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2b99f21a-7ec0-4134-b604-68b1560374b1\start.hta

Filesize
1KB

MD5
9bbdda852677117290a7a3f130638079

SHA1
48390e93abf77599ae64023160cb8ae143189777

SHA256
6e8fcc04c8bf6e07448f7bd47cb304f374873045355b66e160db965ca9685f34

SHA512
1d94b9074ac16cc84b76209a258313282437019838c6b759f8e1c9a665ea104b1e5d197c42b5896b4d89fe7087501017d13a5912272084592c5a218dc635aaa9

Download Submit