156e5d44a429578917d39338fa77a40876643e75df403e059c37c6bedaa89657

Analysis

max time kernel
95s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcd6a3cd52dfbea722456e81e8396f37_JaffaCakes118.exe
Size

105KB
MD5

fcd6a3cd52dfbea722456e81e8396f37
SHA1

c29904992a3bd58980ee8ce97d8df4739117c797
SHA256

156e5d44a429578917d39338fa77a40876643e75df403e059c37c6bedaa89657
SHA512

b90181da0349a8c7e241c4e0d49e08c2c54389546200d191cb2f6d1a3c154bf73537ac5446d0229f020ad7ca3e6b6e69aa0c73207aa7675d60a4d3d9a00ec14a
SSDEEP

3072:lzNWMKKRZYc1ObK91C8sV6Xmoo4MEpYeptCGFI:lZuaObR8sVImPyYepAGm

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	fcd6a3cd52dfbea722456e81e8396f37_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcd6a3cd52dfbea722456e81e8396f37_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	fcd6a3cd52dfbea722456e81e8396f37_JaffaCakes118.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2868	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 2868	3228	fcd6a3cd52dfbea722456e81e8396f37_JaffaCakes118.exe	82
PID 3228 wrote to memory of 2868	3228	fcd6a3cd52dfbea722456e81e8396f37_JaffaCakes118.exe	82
PID 3228 wrote to memory of 2868	3228	fcd6a3cd52dfbea722456e81e8396f37_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\fcd6a3cd52dfbea722456e81e8396f37_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fcd6a3cd52dfbea722456e81e8396f37_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\sn.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sn.txt

Filesize
24B

MD5
7d7e997f0060a58db98ed98cbae3c99a

SHA1
25df97d08ecfc7e21556ef8e542516df1e3f98e0

SHA256
a9bb9f807287a78e2540cb11ef2ccf2688b634e240f18bd3214953c61a3ea714

SHA512
38557c42e4629107d24c5a62467708b966273c4171aeeca0e1714ea912166c4fe701388b4afd9c3f8b08bd50bc86ce595c00345affc782fa332c3bfff41ec5ba

Download Submit
memory/3228-4-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download