d567488c0df5a464780637f19ba8f439260e60807a8aac133caf19a602deed6c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe
Size

97KB
MD5

eeb0e7c25e011504d8b0494cb76566cd
SHA1

6de68b897ce3eb49fb221ee7a85d12666e88824a
SHA256

d567488c0df5a464780637f19ba8f439260e60807a8aac133caf19a602deed6c
SHA512

36fa4d22ed9c5f5b4792e23b54ff6642a7ab14b2c76a1c855cb10718b141bf78172264f84a8ff8d894f69cc28732acead744d4acf8ca5a2c7d5473e5e474b0ba
SSDEEP

1536:K+Ak2NM+6qbymCcoxC4j6VJ37Kb1byOCVxJMbeV/FkCr/XxXdX1VtJ2eIqS8Al:22coxC4j6VJ3u1byOCVxK0/mCTnDfc3

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1864	Traffic Bot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Traffic Bot.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe
Token: SeDebugPrivilege	1864	Traffic Bot.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1864	540	eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe	84
PID 540 wrote to memory of 1864	540	eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe	84
PID 540 wrote to memory of 1864	540	eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\Traffic Bot.exe
  "C:\Users\Admin\AppData\Local\Temp\Traffic Bot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Traffic Bot.exe

Filesize
287KB

MD5
cf9bec787e437ac0a28058c250993bdf

SHA1
7124aca070c0dc0990c4b77e5e6cec30bbbf4537

SHA256
a39eff4521d8491565a347e297ba508ce85d99ef3c1e057c90c4037c6e4d8610

SHA512
18360420eff788efdd02ca96a25ba0d8856b63be86d377b5c26855c335101679b744e56fd1daaf146a703ae93e3215342f595d1e4ea03f631a823045c8317c7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
7KB

MD5
7a7c6480499f6f97d54f9c1ea3b31133

SHA1
6c69a4ee6a9b3eb5ce2e2fb8fd069b3c1ee571f4

SHA256
be83f0724b071c7cfe9bb2265c6ce6a29ef187c61a0e03061d844d69a509e4d8

SHA512
abfd50e5777bdcbf2a2edd415e3df9ab2529febcb443c12f013329c1b178043e135733e7b85f7922f729c76c0edaf1b2d7257348dcba41ea87607e22e5b9094b

Download Submit
memory/540-0-0x00007FFA90343000-0x00007FFA90345000-memory.dmp

Filesize
8KB

Download
memory/540-1-0x0000000000100000-0x000000000011E000-memory.dmp

Filesize
120KB

Download
memory/540-4-0x00007FFA90340000-0x00007FFA90E01000-memory.dmp

Filesize
10.8MB

Download
memory/540-31-0x00007FFA90340000-0x00007FFA90E01000-memory.dmp

Filesize
10.8MB

Download
memory/1864-21-0x0000000004B10000-0x0000000004BA2000-memory.dmp

Filesize
584KB

Download
memory/1864-18-0x00000000050C0000-0x0000000005664000-memory.dmp

Filesize
5.6MB

Download
memory/1864-17-0x0000000004A70000-0x0000000004B0C000-memory.dmp

Filesize
624KB

Download
memory/1864-16-0x0000000000010000-0x000000000005E000-memory.dmp

Filesize
312KB

Download
memory/1864-15-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1864-33-0x0000000004D80000-0x0000000004DD6000-memory.dmp

Filesize
344KB

Download
memory/1864-34-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/1864-32-0x0000000004A30000-0x0000000004A3A000-memory.dmp

Filesize
40KB

Download
memory/1864-35-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/1864-36-0x0000000009300000-0x0000000009366000-memory.dmp

Filesize
408KB

Download
memory/1864-37-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1864-38-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/1864-39-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download