Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-10-2024 21:02

General

  • Target

    2569f447a436080a73542ccfc019bf65_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    2569f447a436080a73542ccfc019bf65

  • SHA1

    19c45eb7c1200fa827df24ee75de2a9e757814f1

  • SHA256

    e3d877a8f99f42e05ed315c01f9243f888dcda642b4a388ced02edab34f0070d

  • SHA512

    53c3df8de1ad2019b499d110903c43a0103fa467e6b87a405c251a9c5d0eee2197dca29c298d3f1586be656a47bac225b1c795dd00b282a1b911191c54e64eb4

  • SSDEEP

    1536:GxYH6A5zgA46YWGMmsGo7eRRneVttMx6Kx5Aqm:THxzYWGMttVtox5+

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2569f447a436080a73542ccfc019bf65_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2569f447a436080a73542ccfc019bf65_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Omf..bat" > nul 2> nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Omf..bat

    Filesize

    238B

    MD5

    61b2188bc3a58017b7e9f90f45117eab

    SHA1

    a7c44b93ca63f84bb4377091aeec2330279dd2db

    SHA256

    a7a06b7ea58b36deccad166c7510d2734fe67c3064d7b6b92e4c37d3acc965ef

    SHA512

    bce898390110250e5b3321c96c65d633718fdc033dacd0e707814d8fbc3bfccd0ad8685734398baa33baf3e64af90c2a4b87ec8eabc61dbb8109a917742ed993

  • memory/3040-0-0x0000000002170000-0x0000000002194000-memory.dmp

    Filesize

    144KB

  • memory/3040-1-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/3040-2-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/3040-5-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB