dd6570f2f96e3838cee770d424f6d6daee1f9dc5e490225b2f842dd1a89d7186

Analysis

max time kernel
96s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118.exe
Size

896KB
MD5

e0997e2159345c338cee0cfea19a4ec4
SHA1

2bbd35cfbd19253cc3de89cca49918b47c2db695
SHA256

dd6570f2f96e3838cee770d424f6d6daee1f9dc5e490225b2f842dd1a89d7186
SHA512

b88834e20636c8a6b01d4e85449c40360c0e8f44b24ec99a1d26d556a456a1fd71b09bdfe8fa668ee171bde81ba1e00380dc7ec122f6f4ad400a4ac3d701145c
SSDEEP

12288:RJXN3tAT0dneSAfLVBIw7otR/SY0VCf0mm/Eggk0Cd7f:3XsmeSAf8Ee0mm/EgF0Kf

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2232	TEST #2.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000c000000023b9e-6.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4896	2232	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEST #2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2448	e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2232	2448	e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118.exe	82
PID 2448 wrote to memory of 2232	2448	e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118.exe	82
PID 2448 wrote to memory of 2232	2448	e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\TEST #2.exe
  "C:\Users\Admin\AppData\Local\Temp\TEST #2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 568
    3⤵
    - Program crash
    PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2232 -ip 2232
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TEST #2.exe

Filesize
865KB

MD5
eee6173c18f6b3ec523809b427712210

SHA1
e7bb7f6e322ac20f7e2d65b48849f863dce4c27c

SHA256
c6082dadd5b10d81a2901fca414442b72bab4c6c2e2e3b07352489ee443d5770

SHA512
359a9ff073a5eb7238e0f45f590e247fade720c1ffcb27b70e2587d0249edc5090c662a22afd5fc117beb3b7e6272df1bbe3a6564c1659e34bf3c2fe7d55c27c

Download Submit