53d0b63e0ca5ec9207daac2d8be9ecccac6e105928af6e5dd5b5f8274879d941

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe
Size

64KB
MD5

f98a95a794a10764e3f7881e65990c05
SHA1

c5ca78ff950a73c53f270117b49fccb35b8d7739
SHA256

53d0b63e0ca5ec9207daac2d8be9ecccac6e105928af6e5dd5b5f8274879d941
SHA512

e4ed6209ab94b8d100f6a5f8a18adaa019ee125de7fb79c051e5334a02f8fe85240f148f7fb0928488aa9a2414ef0fcf35659daf5da10c54ffe73287ba416f5a
SSDEEP

1536:XhHdIlWMQx4IdUsnnuEm+/7zfeyZJ948LrXK:XhH2lOzd7nuEpSM944

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4840-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4908	4840	f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe	82
PID 4840 wrote to memory of 4908	4840	f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe	82
PID 4840 wrote to memory of 4908	4840	f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Mjf..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mjf..bat

Filesize
238B

MD5
c38bd01dabf5dc299c26c138adf09388

SHA1
6918e53e926ea6ae860dd6547198173605a8d878

SHA256
fd14f1a13a2ff287f6f9580b35095c62f5dd6fbdf8e628b49b91ca5a9edd1d3b

SHA512
7abfcfe6fd4d0ac8ceaeabaa8b1e810e193da47aac401ef119e166acd8705817813c34b60a2b4e843bc2ed63dc633447e46bd66baf6694f193f8e93a6d2fd167

Download Submit
memory/4840-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4840-1-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/4840-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4840-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4840-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4840-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download