Analysis

  • max time kernel
    96s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 19:50

General

  • Target

    ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe

  • Size

    385KB

  • MD5

    ec12f24b941ebac9b1b20fa54316c94c

  • SHA1

    234deb459ee1b11c8ce15f69aeaabe81a69455cd

  • SHA256

    c11116e78cadddaecd08ea228afc2a2e17b0feeeff093a4443f8b914acb9913c

  • SHA512

    817a908738474cff89d1f8f63dbb50097cfb3fa566712cabf80345a429969105dc8aeffd65854aef4e1abac4d3ce57a1a29832d740a2d6736e9b82169182a513

  • SSDEEP

    6144:uByddyG377xS2Vp2CeiorXdwTBgWx4v53CpcCJJvH8ddg:Dr7xS2Vp6RwTyCzbJJvH/

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ec12f24b941ebac9b1b20fa54316c94c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe
      "C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe"
      2⤵
      • Executes dropped EXE
      PID:3168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe

    Filesize

    40KB

    MD5

    4905e2edc9b05899ffdde135aa84f223

    SHA1

    508b7e595c9181b04e3f111ed9fa0128f7951b71

    SHA256

    dd3cc350a9623069263a64afb3454f4e05d80d909a37ec610bd36111ebf21662

    SHA512

    d7dac5c35a7b96cff7643ecdfe942a92f1ada9151f3b9e3c4eaf8a7b52c62609bd4eb052428f68096c9ce59db6c61c2372c731044d6c7a3b5b3e70dfe5fa041b

  • memory/3168-25-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3168-24-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3168-22-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3168-23-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3960-3-0x000000001C200000-0x000000001C6CE000-memory.dmp

    Filesize

    4.8MB

  • memory/3960-6-0x0000000001590000-0x0000000001598000-memory.dmp

    Filesize

    32KB

  • memory/3960-7-0x000000001C930000-0x000000001C97C000-memory.dmp

    Filesize

    304KB

  • memory/3960-8-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3960-5-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3960-21-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3960-4-0x000000001C7D0000-0x000000001C86C000-memory.dmp

    Filesize

    624KB

  • memory/3960-0-0x00007FFBC70D5000-0x00007FFBC70D6000-memory.dmp

    Filesize

    4KB

  • memory/3960-2-0x00007FFBC6E20000-0x00007FFBC77C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3960-1-0x000000001BC80000-0x000000001BD26000-memory.dmp

    Filesize

    664KB