51d78051283555f8993d19791f3a1fbc5d4c8b0359b0a34c5051ce3523aaf1cb

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17d91db81189d3aa1e60278911c1d140_JaffaCakes118.exe
Size

200KB
MD5

17d91db81189d3aa1e60278911c1d140
SHA1

01b7ffbce5054d75919a8b5f69388eda3ef12fde
SHA256

51d78051283555f8993d19791f3a1fbc5d4c8b0359b0a34c5051ce3523aaf1cb
SHA512

a53e329158b54822e31660f2e091980fdf2baa969b8130ba6fbf2eab38151be12a02e72d41f60c46b444dd5467497a3f235eddb6615e341e9cef42562899b2ec
SSDEEP

6144:20m22mvOESOmlLUG/2eup0QvvzspR54pR5MiJpR5UJpR5PR5vyjUJ3cRZNrML:gLsOhoGHGvvzspR54pR5MiJpR5UJpR5b

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	17d91db81189d3aa1e60278911c1d140_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17d91db81189d3aa1e60278911c1d140_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 2324	4236	17d91db81189d3aa1e60278911c1d140_JaffaCakes118.exe	82
PID 4236 wrote to memory of 2324	4236	17d91db81189d3aa1e60278911c1d140_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\17d91db81189d3aa1e60278911c1d140_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17d91db81189d3aa1e60278911c1d140_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\cmd.exe
  "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
  2⤵
  - Executes dropped EXE
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cmd.exe

Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit