c01f7f737cb6a218f9de5b3fe6c41df2f86bc671fb42facdce21709688ea0145

Analysis

max time kernel
95s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3aebfec081e99fd39f63c1260f44cd38_JaffaCakes118.exe
Size

148KB
MD5

3aebfec081e99fd39f63c1260f44cd38
SHA1

72caa14a10138289d8eab1d7e1fdc03d4dad54b5
SHA256

c01f7f737cb6a218f9de5b3fe6c41df2f86bc671fb42facdce21709688ea0145
SHA512

63f64c01bc67e6e04fd7c2cc1c49cae5296a3364049bb145a5205dc71deeb14885348e6bed82a5139bf858ec4c11d3243c678dede6926ea73e82914bf7ddb2b7
SSDEEP

768:v8ATV/MFMDEEx1PAy4jyn5jAI8dbFbshQRbYFKvcwhnbrEJOwOU/Huz8aE:vfl6MoEvw+nFARAhmsidhbrEJ/OzO

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	3aebfec081e99fd39f63c1260f44cd38_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/740-3-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3aebfec081e99fd39f63c1260f44cd38_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
740	3aebfec081e99fd39f63c1260f44cd38_JaffaCakes118.exe
740	3aebfec081e99fd39f63c1260f44cd38_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4100	740	3aebfec081e99fd39f63c1260f44cd38_JaffaCakes118.exe	86
PID 740 wrote to memory of 4100	740	3aebfec081e99fd39f63c1260f44cd38_JaffaCakes118.exe	86
PID 740 wrote to memory of 4100	740	3aebfec081e99fd39f63c1260f44cd38_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3aebfec081e99fd39f63c1260f44cd38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3aebfec081e99fd39f63c1260f44cd38_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
238B

MD5
2383a9f03102334eb7e89633476abcdb

SHA1
1b85e04d7f5ab2dac8cb65f661e50b92d4721eb6

SHA256
e05aab75131b2357c9aca3aa46922b9434e6310a5c4e23795e10f004cf0550e0

SHA512
e76ba550e7c0597ed6c519e7d372fd9f31bb88af8151700fd470f437f90c392d4a606676ddcfd5642f99a310b9128ee31d6d0b9ae406c6628634c3aff3340776

Download Submit
memory/740-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/740-3-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download