cdf1b468488fa4f4eaa15b3a4b58241c1beccbdd8471501a63c34fad5acdf044

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2952e7c31eb711ce53ff20ac77010b14_JaffaCakes118.exe
Size

131KB
MD5

2952e7c31eb711ce53ff20ac77010b14
SHA1

4f61d77db873401bf56f86f83b7febffd0f99d63
SHA256

cdf1b468488fa4f4eaa15b3a4b58241c1beccbdd8471501a63c34fad5acdf044
SHA512

605c618368e56a2096bee2761c093d81715c18fc0382e38cfceed086859a979aad98df29f2d959d82e92dc943449dc18dbf32bf78bdab5c34e75cec0f8f9deac
SSDEEP

3072:ob1yE4Eg7yr8s5vJ4rMe9p/zzg3asySEECu0wa0nfUVYq:XJO4sjYMe9p/zzg3asylfX08

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	2952e7c31eb711ce53ff20ac77010b14_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2952e7c31eb711ce53ff20ac77010b14_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 3464	3248	2952e7c31eb711ce53ff20ac77010b14_JaffaCakes118.exe	86
PID 3248 wrote to memory of 3464	3248	2952e7c31eb711ce53ff20ac77010b14_JaffaCakes118.exe	86
PID 3248 wrote to memory of 3464	3248	2952e7c31eb711ce53ff20ac77010b14_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\2952e7c31eb711ce53ff20ac77010b14_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2952e7c31eb711ce53ff20ac77010b14_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Jhj..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Jhj..bat

Filesize
238B

MD5
04b0001e7d21d7aff49e49884ceefa09

SHA1
e86a75df4fc2ab73ed47cd31d3bbeb6da40f4e20

SHA256
32957b2f1865859d659c3c5f0ceb522eaef6be020fcbe3eb6056d359feee05d2

SHA512
a6468c759c5f971a125d874b9255ca3e23e54d5301f0c9bc0f08bea2af6f7194edd99d89207d9c78e2aec7c9e8e685ba63b4c66bb7f2a9212a0371aabe7d9b8e

Download Submit
memory/3248-3-0x000000000041E000-0x0000000000420000-memory.dmp

Filesize
8KB

Download
memory/3248-4-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3248-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download