14c850d8c8a61c4cd4fee483648c0ef47c875f322623b2e4264fb04d5d29776f

Analysis

max time kernel
139s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a09be642870f11183acc94a1aff3802_JaffaCakes118.exe
Size

2.8MB
MD5

8a09be642870f11183acc94a1aff3802
SHA1

0f27cedbbd0b812e9423ce94f1cf60f98e3091c4
SHA256

14c850d8c8a61c4cd4fee483648c0ef47c875f322623b2e4264fb04d5d29776f
SHA512

aa8e01420ae7ec16cda276c24dd496d4ade837f276196e094ee16417b4ab50798472befb05cad49819f9ceae3370da7ae6a218b2744727ce63e9563d2733523e
SSDEEP

49152:b1dlZon5RIAbMURTnd4fmIjDXSrd/T7eCMXdhTV3jbI+lqvZOEjjTVIhem+ni:b1dl2nHgURTnyffXmNT6XTh4v5jZQEni

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8a09be642870f11183acc94a1aff3802_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	8a09be642870f11183acc94a1aff3802_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

servidor.exe

pid	Process
1832	servidor.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

servidor.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	servidor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8a09be642870f11183acc94a1aff3802_JaffaCakes118.exeservidor.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a09be642870f11183acc94a1aff3802_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	servidor.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8a09be642870f11183acc94a1aff3802_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4680 wrote to memory of 1832	4680	8a09be642870f11183acc94a1aff3802_JaffaCakes118.exe	84
PID 4680 wrote to memory of 1832	4680	8a09be642870f11183acc94a1aff3802_JaffaCakes118.exe	84
PID 4680 wrote to memory of 1832	4680	8a09be642870f11183acc94a1aff3802_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\8a09be642870f11183acc94a1aff3802_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a09be642870f11183acc94a1aff3802_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Extracted\servidor.exe
  "C:\Extracted\servidor.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - System Location Discovery: System Language Discovery
  PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Extracted\servidor.exe

Filesize
1.7MB

MD5
fb1141090c3e20c9f176431f2ae6df18

SHA1
d6192762240a73fd1163db7d7eab40203b98ec25

SHA256
a35e42f9330a4487c24d197d205b4c3c2f7e022cb063eac1db9423ff1919fdb9

SHA512
f595fa04ac402fa2d753f8343c1451336da3f1d15d5b6bc29d1943aa5bb5fd80abecd3cfa24dce1a3194643c82a23c09eaa69621161f66ff57bf760478fdf3ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfx.ini

Filesize
220B

MD5
3c34666e8afa2d781c7a417c47e7c39c

SHA1
df4198221e9f9a3f2f26b38ec90a343aff6118ae

SHA256
d880592dbed9008820dd7d4121a2c23a7eefbc8800f838fcf1fdaac2fb349393

SHA512
7a53c5bc31b7a0b545f4b205883a0fd0ddff57bd9df40788985e6e444fc771f891712ee8e5520afcb98c0d02e83184b51a4270e0d6c1c18c7f54a79bfb40f80e

Download Submit
memory/1832-25-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/1832-26-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download