5ef9dc33b11353e39767538992fa7c50e40cc0fdaed0903ab9282e73ac660a30

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe842cb6e508d8221960d27d2180877e_JaffaCakes118.exe
Size

49KB
MD5

fe842cb6e508d8221960d27d2180877e
SHA1

61f2645c79723259a1810f7784bb0e6582cdcdf2
SHA256

5ef9dc33b11353e39767538992fa7c50e40cc0fdaed0903ab9282e73ac660a30
SHA512

2ccdd904b5142e3dc15e46a87cb66e5afbf79b91779c17656cd42f8112561694d4478ef93bb3fca09b4ef319c21407e322cb7eb9d0836af41db37590774531b5
SSDEEP

768:EyW1yBtObv0U/xwPp0EoooiYECG2nZF5sZVcmx7:24Bobv7aB0EooYEC3rUVcY7

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	fe842cb6e508d8221960d27d2180877e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3276	zbhnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zbhnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe842cb6e508d8221960d27d2180877e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3276	1980	fe842cb6e508d8221960d27d2180877e_JaffaCakes118.exe	82
PID 1980 wrote to memory of 3276	1980	fe842cb6e508d8221960d27d2180877e_JaffaCakes118.exe	82
PID 1980 wrote to memory of 3276	1980	fe842cb6e508d8221960d27d2180877e_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\fe842cb6e508d8221960d27d2180877e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe842cb6e508d8221960d27d2180877e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
  "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zbhnd.exe

Filesize
50KB

MD5
3efa11cc2370f702f55400c7a6fc4623

SHA1
061eadb0e8aad34d21588fdc7163c44357e6ef24

SHA256
b1c096c316b85dd2c1c5a04ff8fd38ea59c56699f8e6a0fe3f0350e14717ea97

SHA512
41966dc139ba5cde5c561543680a4cce32b16af0738aef30dd7b74e9a15b0acce74eb4a74dade01830366c5b2b864390ae1ac39c60aa06c391d6d210e6046e25

Download Submit
memory/1980-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1980-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1980-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3276-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download