0ab02b2dc4b7cead835754f0d2950cc11d9298660c596c6ea72cb4daba5d0dcc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eed3cf09db68cd3281bd72eb9eab5285_JaffaCakes118.exe
Size

6.7MB
MD5

eed3cf09db68cd3281bd72eb9eab5285
SHA1

7e994a05fb1890ff779a02ccd8e54d6397246317
SHA256

0ab02b2dc4b7cead835754f0d2950cc11d9298660c596c6ea72cb4daba5d0dcc
SHA512

1f0195ed6af484ccf2a576fdeceb5884b8beac1db50b02916e4285275f0f7b80d8a4be1e24c973c42e80bbeeb139fc51e8629f51e90ecc1e239aaaf8075e60dd
SSDEEP

768:ToyzZ7iG6u4PtaGhgJ+VqQtKHPsd7MZe8PTSaSftJUJmJ1Ltpgtexlr:97JcaGhWSFKsd7MZe8POHfn/pga

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	KB416588.EXE

Executes dropped EXE 1 IoCs

pid	Process
4216	KB416588.EXE

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRAM FILES\WINDOWSUPDATE\KB416588.EXE	eed3cf09db68cd3281bd72eb9eab5285_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\WINDOWSUPDATE\KB416588.EXE	eed3cf09db68cd3281bd72eb9eab5285_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eed3cf09db68cd3281bd72eb9eab5285_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KB416588.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4216	4440	eed3cf09db68cd3281bd72eb9eab5285_JaffaCakes118.exe	83
PID 4440 wrote to memory of 4216	4440	eed3cf09db68cd3281bd72eb9eab5285_JaffaCakes118.exe	83
PID 4440 wrote to memory of 4216	4440	eed3cf09db68cd3281bd72eb9eab5285_JaffaCakes118.exe	83
PID 4216 wrote to memory of 388	4216	KB416588.EXE	84
PID 4216 wrote to memory of 388	4216	KB416588.EXE	84
PID 4216 wrote to memory of 388	4216	KB416588.EXE	84

C:\Users\Admin\AppData\Local\Temp\eed3cf09db68cd3281bd72eb9eab5285_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eed3cf09db68cd3281bd72eb9eab5285_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440
- C:\PROGRAM FILES\WINDOWSUPDATE\KB416588.EXE
  "C:\PROGRAM FILES\WINDOWSUPDATE\KB416588.EXE" C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\EED3CF09DB68CD3281BD72EB9EAB5285_JAFFACAKES118.EXE
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /Q del C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\EED3CF09DB68CD3281BD72EB9EAB5285_JAFFACAKES118.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WINDOWSUPDATE\KB416588.EXE

Filesize
14.1MB

MD5
fdb4a18197fa35494c4923bd47276c66

SHA1
62004befb2afb74897885c2ecf6efd67e8156f0c

SHA256
fef25ba691f93e3a8e364ac985323530babff7f48aa2d32380d6cb063defebe9

SHA512
d80629d2c126be674af832319d4a2be60fd61be702044a7d341f473c26d1b51c57e19f077be170e796b52c649b55407b2e369f85f4f969e8c2e6b98fbf34bf54

Download Submit
memory/4216-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4440-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4440-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/4440-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download