8ac313b05ef8bf20d88e471ce6128287b76c2309436ca66bf4ddd7707d11e660

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
Size

2.8MB
MD5

dc934a8ebaa131044c6d2cc89a0924db
SHA1

0ed4478358f60deaa99b7b5ca2e5e92f71363e74
SHA256

8ac313b05ef8bf20d88e471ce6128287b76c2309436ca66bf4ddd7707d11e660
SHA512

045439f6f54ee418d955e645762e157021bdc75eaec7db6d29a3eb2f6a347346926659c903f30d84c91754609248386f5492e95424c46c84e580504a805f76ac
SSDEEP

49152:UrTt1IaV9AgZKA5acoIKwg8ydnKCgl+jSVh5APgUzStr:UrB1IaVmgM8accPe+KWCr

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2916	isass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isass.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
2916	isass.exe
2916	isass.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2916	1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe	86
PID 1580 wrote to memory of 2916	1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe	86
PID 1580 wrote to memory of 2916	1580	dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc934a8ebaa131044c6d2cc89a0924db_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\isass.exe
  "C:\Users\Admin\AppData\Local\isass.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\isass.exe

Filesize
537KB

MD5
ddd81422a680c7c089af0a939276f71d

SHA1
f96327e4c058d5c5717c5916ae9eee8c0bad9092

SHA256
74e532beb9e3580c5bb911d1954791a68f33094e19e7674ce9371f1684537b9e

SHA512
75109eb9bdd43f3354633704fbb4b073584e8a6ec88ec55db193e38c96468f235b93117beb32168f716cba04dd3485e85b74c14b882d99340e3abab9e9218fb2

Download Submit
memory/1580-0-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/1580-19-0x0000000000400000-0x00000000006D4000-memory.dmp

Filesize
2.8MB

Download
memory/2916-16-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2916-21-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2916-20-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download