e04b9ea8d977059ae11c0f9ed5b4dac36195c2dc569b8cc1cc7f9b8e95ce7eec

Analysis

max time kernel
121s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe
Size

188KB
MD5

eebe41bea4001decb58d5d64a42c9dc6
SHA1

778d20e8f40241586f0158078bf08515f0f08721
SHA256

e04b9ea8d977059ae11c0f9ed5b4dac36195c2dc569b8cc1cc7f9b8e95ce7eec
SHA512

95f2d90e890f3b46e941d8f2591b029df2b2de53552e010da5199cddaae7ea78c63e2f42756a5bc1c57cba96f8a202639eb3233610f08a4f2b90f2f136e5609f
SSDEEP

1536:EvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcj0Srowm0:EvVQLIkLWeaA8KlCph9hrowm0

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3532	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\af8f78e7\jusched.exe	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe
File created	C:\Program Files (x86)\af8f78e7\af8f78e7	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3532	1152	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe	86
PID 1152 wrote to memory of 3532	1152	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe	86
PID 1152 wrote to memory of 3532	1152	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files (x86)\af8f78e7\jusched.exe
  "C:\Program Files (x86)\af8f78e7\jusched.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\af8f78e7\af8f78e7

Filesize
17B

MD5
7bdf61d37c9adf3e1c6937107016091f

SHA1
56b8e0c454f9dd16d508a04b3afa7e458453ac41

SHA256
4c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0

SHA512
ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1

Download Submit
C:\Program Files (x86)\af8f78e7\jusched.exe

Filesize
188KB

MD5
a9af0db803ed1051c99ed84c29763d2f

SHA1
e99ea81bfa07107191208a614e46afcf5e352326

SHA256
615df9022a7ec986e8f0a8641b18b7fb55e13f9ced7ea299c4099e740240d001

SHA512
e6d7232ab1aa4070382dfcbe817852b91a6ad8b2b418635a6115191497370c479597fdcf2357631d1d7aef1ea222e49b4610bb0db331fdf8778865184be4c07f

Download Submit