8967b4b2135fc726882f7fa7c207bdbc6671f107cad00717f0d971404226ad9d

Analysis

max time kernel
95s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fdfad7cc57a9fe35d9ac0a522487d304_JaffaCakes118.exe
Size

72KB
MD5

fdfad7cc57a9fe35d9ac0a522487d304
SHA1

bd666ec3a5509e30f111ab319105dcee1bddddca
SHA256

8967b4b2135fc726882f7fa7c207bdbc6671f107cad00717f0d971404226ad9d
SHA512

6db04f4c12a70d08ef6f488ee3f1ec7a841db007a227e818fbedf8dc8e147bc40064880aab3c336da9457c304f8a60734323dde157e40524c6211829d005d3da
SSDEEP

1536:K1UfG4FtE/r/I6uVOrFeGEIIwodsohNt4ZMwyVa:S4/2r/InpfINoz5wx

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	fdfad7cc57a9fe35d9ac0a522487d304_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdfad7cc57a9fe35d9ac0a522487d304_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2304	4632	fdfad7cc57a9fe35d9ac0a522487d304_JaffaCakes118.exe	82
PID 4632 wrote to memory of 2304	4632	fdfad7cc57a9fe35d9ac0a522487d304_JaffaCakes118.exe	82
PID 4632 wrote to memory of 2304	4632	fdfad7cc57a9fe35d9ac0a522487d304_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\fdfad7cc57a9fe35d9ac0a522487d304_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdfad7cc57a9fe35d9ac0a522487d304_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Gqv..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Gqv..bat

Filesize
238B

MD5
6bf2b1f796ccf92d6e2d6fad0745c5a7

SHA1
fadb64b143855f8508835837da90b99b4beddc6b

SHA256
e71e13dc3c986be58bff3688d2a7a261e3c998fd583cc4bcc5faf482c0ff9d37

SHA512
70c3d2d9a2fc7117d2c93fc328511966c06e23e628c9a11dd1b8fa041294f8a889daef5a5b345bac8e69438ab7c7cc16329dbe72d6a22f92d66d14ce23483c6f

Download Submit
memory/4632-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4632-2-0x0000000000690000-0x00000000006AB000-memory.dmp

Filesize
108KB

Download
memory/4632-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4632-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4632-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4632-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download