61a58b0262c4ece010634f0292c450eda6dfccbd1dea61a6be3d67ea8a1fe513

Analysis

max time kernel
135s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

278589c5dcc29e9b1053228881e9f3f6_JaffaCakes118.exe
Size

105KB
MD5

278589c5dcc29e9b1053228881e9f3f6
SHA1

7059e957b12f49aafcb5ae6074a18edebded3808
SHA256

61a58b0262c4ece010634f0292c450eda6dfccbd1dea61a6be3d67ea8a1fe513
SHA512

3b5aca0f8aaa2e4aa5687fb3239c04f261f1da11059560e4d4df24dc97f567b4985d437b6899860e2b2fd3999823365f98504fce1dc17e7775fc5010e895d996
SSDEEP

768:V+KGZdJueOxr1PuarJHlVBQavxWOf+u4Dt0XtCVJGCIzIsaJHRQCAxtXfq:VDGEr1PDVBQiWe+b0X0nEIs0RQtXy

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	278589c5dcc29e9b1053228881e9f3f6_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2328-2-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	278589c5dcc29e9b1053228881e9f3f6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2328	278589c5dcc29e9b1053228881e9f3f6_JaffaCakes118.exe
2328	278589c5dcc29e9b1053228881e9f3f6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 3632	2328	278589c5dcc29e9b1053228881e9f3f6_JaffaCakes118.exe	88
PID 2328 wrote to memory of 3632	2328	278589c5dcc29e9b1053228881e9f3f6_JaffaCakes118.exe	88
PID 2328 wrote to memory of 3632	2328	278589c5dcc29e9b1053228881e9f3f6_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\278589c5dcc29e9b1053228881e9f3f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\278589c5dcc29e9b1053228881e9f3f6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
238B

MD5
cb5a7e6ecdb20c16cc70f2e063175632

SHA1
028176d884630f0e87728d2a00a823767bf8961d

SHA256
dfa0e0dee578ed8e7660855357c02b04a51dc60b33b382494b281e6b30dbd7b6

SHA512
157add1ca711c6e26e1faf08c976ee3890cb1b3d60ae98c823d5bad4f5a7ccb280cc253664ac1e2c58192a85d6a15ccff96238b87a53e030d116e6b68f731085

Download Submit
memory/2328-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2328-2-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download