bc141893c01d5ec8e778676f9dbdf20205f48e0dce54f56d583712b6bfe98b23

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3aecc313c86a183dc5b1b17a335822ef_JaffaCakes118.exe
Size

16KB
MD5

3aecc313c86a183dc5b1b17a335822ef
SHA1

c6d9b465a15ef440aa30cab0ed330b656c332466
SHA256

bc141893c01d5ec8e778676f9dbdf20205f48e0dce54f56d583712b6bfe98b23
SHA512

33dd08a1143daa3511f61b94aa0d59f37d987e6ba4a70f0795858174c488552366a0d1bf9c338748247b14919175296a023857c11b3f226087b3cca83f2ef700
SSDEEP

192:/icaHhyQ8XPuy524LwlYzlcqeyFfq0CD6:6V8XPr5H0lYzJ5qTW

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	3aecc313c86a183dc5b1b17a335822ef_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3aecc313c86a183dc5b1b17a335822ef_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	3aecc313c86a183dc5b1b17a335822ef_JaffaCakes118.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4968	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4968	4928	3aecc313c86a183dc5b1b17a335822ef_JaffaCakes118.exe	86
PID 4928 wrote to memory of 4968	4928	3aecc313c86a183dc5b1b17a335822ef_JaffaCakes118.exe	86
PID 4928 wrote to memory of 4968	4928	3aecc313c86a183dc5b1b17a335822ef_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3aecc313c86a183dc5b1b17a335822ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3aecc313c86a183dc5b1b17a335822ef_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\musu.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\musu.txt

Filesize
998B

MD5
aef43ac0c2187e7339d9520b81b200d0

SHA1
9af6affb64ac824f77d6a97f6e95ab830518bc0d

SHA256
6bdb200bd13416732c19765ea8a9cdce9ff2a4adff16d067a6a786cf5b5eb6e0

SHA512
2c3e67305a8a023edda0519d58dad3dff4dfb2d429ab0e91163eb164cfa98d1b8ae5b19d575187b013302bd6dc172ec6ddaeb8c94d79d02a6b1b18f01cb4f03b

Download Submit
memory/4928-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download