d6fd9f8023ea24a97c2e392e2f35c5f8f852a795121dc8b9bc6734a50e36a7e3

Analysis

max time kernel
128s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
Size 804KB
Sample250127-shavwsvmcr
SHA256 d6fd9f8023ea24a97c2e392e2f35c5f8f852a795121dc8b9bc6734a50e36a7e3
MD5 40d1757e9c780835836d1810748c2435
SHA1 369dee05027c3bca1043a2e74a1c481832f4177c
SHA512 28bdcafa515a1261b672fe871d62c77829a8b9e6565100332aea55e6a7eef7d398a3eae1ca454fb6fab6eaa0a0e2b9e4ceb9d83f91894a18bed796d1407d342f
SSDEEP 24576:M0aNNdDEuDbbETLHzQlrnTfvecXz7tcTIlXdtQO6kldiDDUn:MLVDU3HQzeScTIlXdtpjim
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe

Loads dropped DLL 7 IoCs

pid	Process
3424	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
3424	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
3424	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
3424	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
3424	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
3424	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
3424	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\!iLividOnce = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_40d1757e9c780835836d1810748c2435.exe"	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\JaffaCakes118_40d1757e9c780835836d1810748c2435.exe\IsHostApp	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\JaffaCakes118_40d1757e9c780835836d1810748c2435.exe	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3368	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 3368	3424	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe	84
PID 3424 wrote to memory of 3368	3424	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe	84
PID 3424 wrote to memory of 3368	3424	JaffaCakes118_40d1757e9c780835836d1810748c2435.exe	84

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40d1757e9c780835836d1810748c2435.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40d1757e9c780835836d1810748c2435.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\nsj760C.tmp\license.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Helper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj760C.tmp\Helper.dll
Size 1.0MB
SHA256 d0b3e7f9b304b88fe7de3b81afc1c64f40d7b2237721225a15a564ae62b34e66
MD5 cf0e9192667cdedfacc8646e38bd9686
SHA1 4741ac6de1d309210279795e1c7cd7f21cee6f17
SHA512 b8a47fc2c706822eb0adfa820d24330901454fe37b6c93270f2fc89aa4b05e9e1527820af1f3f674b6d8696ed79722cc51eeb12e7e1762e112e7bad69327d36c
SSDEEP 12288:6atQ0QAsqP85SFuNrC8b+qyPyTlkmn4IiaLgfeC:jtQ06M8Sqy6Tlkmn4IvieC
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj760C.tmp\System.dll
Size 11KB
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj760C.tmp\UAC.dll
Size 13KB
SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
MD5 a88baad3461d2e9928a15753b1d93fd7
SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
MD5 SHA1 SHA512 SSDEEP

Submit Download

license.txt

Path C:\Users\Admin\AppData\Local\Temp\nsj760C.tmp\license.txt
Size 18KB
SHA256 46aefaa17e63ef0fbc4ea1ed1c405bd8d55ce1cc107151404ad79fd78838cd1e
MD5 adc52e4df9473983d7c1bbe0f67b2891
SHA1 70cd5b1954d485c1c5819329c42c2f83f3add182
SHA512 0f00a030b8831c6dddcf093a1b63bd3d5757b8de7c41d7c5560872d6f6900efd9df77f7a9170e03d7b211cd6ca5ee00dcb0b5762870868a3c8c777ca4c71d4bf
SSDEEP 384:LdOmrJYeVR7P5/Udi6f8MWBrK3Kx2P74d0jrrK3Qv6c543Sr4cB/EGy5y06:L9rXP2iQ8Xpx2PMqjrhvsNe/EG2yP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj760C.tmp\nsDialogs.dll
Size 9KB
SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
MD5 f7b92b78f1a00a872c8a38f40afa7d65
SHA1 872522498f69ad49270190c74cf3af28862057f2
SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3424-30-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Download

memory/3424-32-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads