01a7fd13a5d9bc4c3df930b3bec5530070dcdf1c6d123153ffa1461d10538349

Analysis

max time kernel
139s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe
Size

95KB
MD5

52c5647a979eee577d96997c5ca6e013
SHA1

be0f36ead48275ed8ecb4c131e5b086fa40398f1
SHA256

01a7fd13a5d9bc4c3df930b3bec5530070dcdf1c6d123153ffa1461d10538349
SHA512

6ab998e6be4d09ea1b5e9cf52c03215d962991424d23b0b9069dea3e284a9afde73d522fee133319a3559fd93744735a9f58c26cfd539007d2ea034705e3183e
SSDEEP

1536:ngq7Q6D8bLe/Mkdbx69+zBSzZoaMqBQmIpXx23spZm8unWN4+2ax:bLL/n16EdSu8PIpXAEZTOW75x

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3732	123.exe
3200	Kernelmoduleunloader.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sysgui.gif	123.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kernelmoduleunloader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3732	123.exe
3732	123.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3732	4996	52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe	84
PID 4996 wrote to memory of 3732	4996	52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe	84
PID 4996 wrote to memory of 3732	4996	52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe	84
PID 4996 wrote to memory of 3200	4996	52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe	85
PID 4996 wrote to memory of 3200	4996	52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe	85
PID 4996 wrote to memory of 3200	4996	52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\52c5647a979eee577d96997c5ca6e013_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\123.exe
  "C:\Users\Admin\AppData\Local\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Users\Admin\AppData\Local\Temp\Kernelmoduleunloader.exe
  "C:\Users\Admin\AppData\Local\Temp\Kernelmoduleunloader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\123.exe

Filesize
23KB

MD5
ec88c1ead502770b4f591923b1018e94

SHA1
228b84221c56b4fa42668022d31ccfdc8fd755a8

SHA256
c68a0533740968606bb88c32c0cdc10f76e58ba27d6aa7532800dd8e6e1c049c

SHA512
b6df7f468f5ada67eff65e0d47421cbe7df671f48da9eb92c3f740b1b00a88b1d64e71ab0d65e2e49177ee73b6dd3e2828b65e327e07e3834b6cfa3cbeaa768c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kernelmoduleunloader.exe

Filesize
45KB

MD5
7b273902b8381c5d2663e3f2bc5f19e6

SHA1
6766486f787bbcb2a6ad48ecb357cbbfb0150610

SHA256
afe041aa6192ac08d41ecfe535a30fc4462912eca87f4483b33aa6e22c0fbb75

SHA512
abf097b6c5de38d6325ed78a5383d177f6cc2eca8de404354c0f8ddb12629afdfcde58fb1083a1ad02e1e0589e2ce71abb5a1b850f5d5d7b184b2d9b9b5334c8

Download Submit
memory/3200-19-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4996-18-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download