c11116e78cadddaecd08ea228afc2a2e17b0feeeff093a4443f8b914acb9913c

Analysis

max time kernel
96s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 19:50 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe
Size

385KB
MD5

ec12f24b941ebac9b1b20fa54316c94c
SHA1

234deb459ee1b11c8ce15f69aeaabe81a69455cd
SHA256

c11116e78cadddaecd08ea228afc2a2e17b0feeeff093a4443f8b914acb9913c
SHA512

817a908738474cff89d1f8f63dbb50097cfb3fa566712cabf80345a429969105dc8aeffd65854aef4e1abac4d3ce57a1a29832d740a2d6736e9b82169182a513
SSDEEP

6144:uByddyG377xS2Vp2CeiorXdwTBgWx4v53CpcCJJvH8ddg:Dr7xS2Vp6RwTyCzbJJvH/

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3168	Exploit Chams.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 3168	3960	ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe	81
PID 3960 wrote to memory of 3168	3960	ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe
  "C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe"
  2⤵
  - Executes dropped EXE
  PID:3168

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

79.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.190.18.2.in-addr.arpa

IN PTR

Response

79.190.18.2.in-addr.arpa

IN PTR

a2-18-190-79deploystaticakamaitechnologiescom
DNS

4.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

4.159.190.20.in-addr.arpa

IN PTR

Response
DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR

Response
DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

171.39.242.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.39.242.20.in-addr.arpa

IN PTR

Response
DNS

45.56.20.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

45.56.20.217.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

216.143.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

216.143.123.92.in-addr.arpa

IN PTR

Response

216.143.123.92.in-addr.arpa

IN PTR

a92-123-143-216deploystaticakamaitechnologiescom
DNS

48.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

48.229.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

79.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

79.190.18.2.in-addr.arpa
8.8.8.8:53

4.159.190.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

4.159.190.20.in-addr.arpa
8.8.8.8:53

196.249.167.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

196.249.167.52.in-addr.arpa
8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

171.39.242.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

171.39.242.20.in-addr.arpa
8.8.8.8:53

45.56.20.217.in-addr.arpa

dns

71 B
131 B
1
1

DNS Request

45.56.20.217.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

216.143.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

216.143.123.92.in-addr.arpa
8.8.8.8:53

48.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

48.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe

Filesize
40KB

MD5
4905e2edc9b05899ffdde135aa84f223

SHA1
508b7e595c9181b04e3f111ed9fa0128f7951b71

SHA256
dd3cc350a9623069263a64afb3454f4e05d80d909a37ec610bd36111ebf21662

SHA512
d7dac5c35a7b96cff7643ecdfe942a92f1ada9151f3b9e3c4eaf8a7b52c62609bd4eb052428f68096c9ce59db6c61c2372c731044d6c7a3b5b3e70dfe5fa041b

Download Submit
memory/3168-25-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

Filesize
9.6MB

Download
memory/3168-24-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

Filesize
9.6MB

Download
memory/3168-22-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

Filesize
9.6MB

Download
memory/3168-23-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

Filesize
9.6MB

Download
memory/3960-3-0x000000001C200000-0x000000001C6CE000-memory.dmp

Filesize
4.8MB

Download
memory/3960-6-0x0000000001590000-0x0000000001598000-memory.dmp

Filesize
32KB

Download
memory/3960-7-0x000000001C930000-0x000000001C97C000-memory.dmp

Filesize
304KB

Download
memory/3960-8-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

Filesize
9.6MB

Download
memory/3960-5-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

Filesize
9.6MB

Download
memory/3960-21-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

Filesize
9.6MB

Download
memory/3960-4-0x000000001C7D0000-0x000000001C86C000-memory.dmp

Filesize
624KB

Download
memory/3960-0-0x00007FFBC70D5000-0x00007FFBC70D6000-memory.dmp

Filesize
4KB

Download
memory/3960-2-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

Filesize
9.6MB

Download
memory/3960-1-0x000000001BC80000-0x000000001BD26000-memory.dmp

Filesize
664KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.