1fdd6afe7ef74cbdeff1260be45a3cf75a7319730796645920bb99096d507fae

Analysis

max time kernel
95s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e2a1fe323eee2188d789e712173f687b.exe
Size

442KB
MD5

e2a1fe323eee2188d789e712173f687b
SHA1

0c5370318e984b88de2a4f1db10f5de9d394bb96
SHA256

1fdd6afe7ef74cbdeff1260be45a3cf75a7319730796645920bb99096d507fae
SHA512

0a596f71612066a1e6b69aed5ecb833631ff6b5e7e1e198e82faffe23682e44a2590765a4208ddf18676a072461a4a188689a124cf8a985dcf5b1b443eb1829d
SSDEEP

12288:LAZH5M/VKU8bSCd51qpF0k5acA96KFeUi:LWHO/VKU83d51qYYSITH

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_e2a1fe323eee2188d789e712173f687b.exe

Executes dropped EXE 1 IoCs

pid	Process
1560	Keygen.exe

Loads dropped DLL 1 IoCs

pid	Process
1560	Keygen.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b000000023b75-4.dat	upx
behavioral2/memory/1560-8-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/1560-16-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e2a1fe323eee2188d789e712173f687b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2844	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2844	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 1560	4452	JaffaCakes118_e2a1fe323eee2188d789e712173f687b.exe	83
PID 4452 wrote to memory of 1560	4452	JaffaCakes118_e2a1fe323eee2188d789e712173f687b.exe	83
PID 4452 wrote to memory of 1560	4452	JaffaCakes118_e2a1fe323eee2188d789e712173f687b.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2a1fe323eee2188d789e712173f687b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2a1fe323eee2188d789e712173f687b.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Keygen.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Keygen.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d0 0x464
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Keygen.exe

Filesize
162KB

MD5
321c44b7664ee31a714bcc241a1f4bd0

SHA1
2fa0afd535cc9a53c1659499617541312ceebec2

SHA256
af3925b2b28bf3880a671320b550f117a2132f65d090f551b5c60e5b93832f33

SHA512
f6c9140adcd30bf2169264c7d2b87403dbfaba74352b2f1ecd4a96be9112b53fd068d353cf6f2facccc3fa4cf80d7691ed2bdc7e8f10896d5102cc9590c9ec6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
memory/1560-8-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1560-13-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1560-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4452-17-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download