939d340c782bc0348242686c9bc8dc4889253fda71b3719a93e9131b98db00b8

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6592e38e77d6c5397858b6af72d57cb_JaffaCakes118.exe
Size

65KB
MD5

f6592e38e77d6c5397858b6af72d57cb
SHA1

23bad5abbf691609fe4f4c3e48b7cf7ea93bad7f
SHA256

939d340c782bc0348242686c9bc8dc4889253fda71b3719a93e9131b98db00b8
SHA512

8409b079809308a06e737a000bb619ededf1d0c3dc6bafa0d9765e82eeeeae02bf6c8a187e86e8284eec6e2afe14a71b01bf7bb49316ac3f9a7955ab416b03fc
SSDEEP

768:PAFu1AP7bfEWs9VkPa+9CpYCFS3y4ahYiwK/1p7vPLm:PYxEWsMJ9CpYn3kl9PL

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	f6592e38e77d6c5397858b6af72d57cb_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6592e38e77d6c5397858b6af72d57cb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f6592e38e77d6c5397858b6af72d57cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6592e38e77d6c5397858b6af72d57cb_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\plugs\mmc240614906.txt

Filesize
1KB

MD5
618ec867b2698c2b7746c7185525a2ed

SHA1
40c7800826163d8664dd09fa4c9e469d7adcbedf

SHA256
75a5c242b775f242579780154625e7ee1f3f80c551b419ae404f5483bc2e1598

SHA512
ef92993a7a981f23a0bb33e7b6afdd2ab60835f1a02d0780fe54d7aad9facc93a5ec2ab7c6c46d24b299af3aa6c96902476e5ccd8e29a9a0192304356c7ed635

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\plugs\mmc63.exe

Filesize
1KB

MD5
f674d1989664242e9b19da43b6863b22

SHA1
9c6c376069853085a18c8db413c9be6c385a6978

SHA256
cad368af06818352adcb0a38de2e365eaeb920b79d81c7b950b6b2ff1db0ac5e

SHA512
6dfc1d5622638e50c80778de41e211d2d3ee0cce323f8452583322ac4d9af8bb089bce492780cf710887d69fd7132b27b59b6b19810e4edf800d6a81aa6ae8e5

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\plugs\mmc63.exe

Filesize
1KB

MD5
1be98c7949339ce968e2dfa3460ae69f

SHA1
6cb519ba34b9d6ae7555e0cf98452905d647f8d8

SHA256
9c58aa85959a2c01728bd8bb6ae6eaec8617b9afeb4ebb2bd1a3574a3b92fc46

SHA512
a9d901934d0d469a214c673e7231b8ab3095bb4f6b48e933e3611304d0bc11924544f09e9a7172a1fed611b3fb14aadf3c672bd596251cc519f215e7b30fc89d

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\plugs\mmc63.exe

Filesize
1KB

MD5
db58fe93af7f3f3ac3c9c6d11f6f0300

SHA1
2b4c115e0930724dd0ecfc1935860a9d38cd5d7b

SHA256
7899f53ef94c98b14c31cbe19ae8b57f7a009d22b69123bd9df8cbd94b40da82

SHA512
dca42b80ac0c96a51b4fa5d135c929072cdacc86397fb58009d653993d040d3d92cd6e3778f12c6488e879a5d2422f2132b6d558ff5e5deb63e619ca53382b60

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\plugs\mmc63.exe

Filesize
1KB

MD5
dc285323f6d4b4025a311c48ab8b4a08

SHA1
b4067511979fee7550d18f7aace2bc52a6451448

SHA256
988c028d31975f91b37d02b9d3e5e43d8994e6b8e16783739feb468b5b317ac4

SHA512
b407a6a3ae7c370f6f37ce541ceb6b520eb7911c1295d7c0508e7818dee9920c96b0cd4cf60b6009a93b39b12b415c5262de46e22adfafdf71ed8d3e22a6e556

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\plugs\mmc63.exe

Filesize
1KB

MD5
798472e7b84071bcb67452419111fa1e

SHA1
1489abc4e2358ea1d086b24fa001c3257bc96339

SHA256
78f8467b967695562c9b449bb51d7e100ed261c113995d83a497925f3cfbf0da

SHA512
6d4f5e60427ad3c3b7bd9f700c04517f4e2a174ba8a74c6b8a494e792af6f3bb2ce935a9e5b80efc9037f9924760b1d104324ca7e16f585cda7d84a2ac3ed7d6

Download Submit
memory/4848-0-0x0000000002160000-0x0000000002174000-memory.dmp

Filesize
80KB

Download
memory/4848-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4848-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4848-43-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4848-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4848-97-0x0000000002160000-0x0000000002174000-memory.dmp

Filesize
80KB

Download