acffea4c860b5dfafaf26e6aa764c3ac863e21b071ef10ca7ecb771b0e7dfe36

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 20:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_439e95b0a93c551282182452f0380ba1.exe
Size 72KB
Sample250127-zrkvsawkar
SHA256 acffea4c860b5dfafaf26e6aa764c3ac863e21b071ef10ca7ecb771b0e7dfe36
MD5 439e95b0a93c551282182452f0380ba1
SHA1 6a749be3672976fbb7ac1781c81502f7763b9f22
SHA512 4efa2191dabe725ec7b3a6cbbc6dfacc7d5d2068ada20a2f618206f24ba3a2126ae584d02727cc129e7545bb0826cb64e9ffa8d5ec5793175c3d341f985db53a
SSDEEP 1536:72c4eajkvbFIiLqn7RXfvEL0P02657SSR68Bw1j6LE2uj:pvDL87RXk08265WP8yJ0E2w
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	JaffaCakes118_439e95b0a93c551282182452f0380ba1.exe

Executes dropped EXE 1 IoCs

pid	Process
396	SeRvEr18.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_439e95b0a93c551282182452f0380ba1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SeRvEr18.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
396	SeRvEr18.exe
396	SeRvEr18.exe
396	SeRvEr18.exe
396	SeRvEr18.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4444	JaffaCakes118_439e95b0a93c551282182452f0380ba1.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 396	4444	JaffaCakes118_439e95b0a93c551282182452f0380ba1.exe	83
PID 4444 wrote to memory of 396	4444	JaffaCakes118_439e95b0a93c551282182452f0380ba1.exe	83
PID 4444 wrote to memory of 396	4444	JaffaCakes118_439e95b0a93c551282182452f0380ba1.exe	83
PID 396 wrote to memory of 3456	396	SeRvEr18.exe	56
PID 396 wrote to memory of 3456	396	SeRvEr18.exe	56
PID 396 wrote to memory of 3456	396	SeRvEr18.exe	56
PID 396 wrote to memory of 3456	396	SeRvEr18.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3456
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439e95b0a93c551282182452f0380ba1.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439e95b0a93c551282182452f0380ba1.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\SeRvEr18.exe
    "C:\SeRvEr18.exe" 0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SeRvEr18.exe

Path C:\SeRvEr18.exe
Size 31KB
SHA256 9cb943a84bde9f82a0b6b8af1f01ae3e670001c85eb6b581949e0697bea0241f
MD5 d919014d75e589d0a3934112a20c8ae0
SHA1 de1af63654de8ddcf233e15ba120b8b08a06bb40
SHA512 90761b332da8bf8e27feb9139d1a9740e76f8f3bd948715cc0ae6d9c39f5206581afdc9b6a6c034f7cb50bf1304923ad9f6ad225fe6ba5f365f1d8e9ec759586
SSDEEP 768:Z+h7TzTBziifTeiZSVWihwEknh0L7OTLeNfQfVK:kZ/nEkh8OTKNUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

88603cb2913a7df3fbd16b5f958e6447_4304acb9-c3f6-452a-9860-eb4e85d38d4e

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2437139445-1151884604-3026847218-1000\88603cb2913a7df3fbd16b5f958e6447_4304acb9-c3f6-452a-9860-eb4e85d38d4e
Size 51B
SHA256 374e0e2897a7a82e0e44794cad89df0f3cdd7703886239c1fe06d625efd48092
MD5 5fc2ac2a310f49c14d195230b91a8885
SHA1 90855cc11136ba31758fe33b5cf9571f9a104879
SHA512 ab46554df9174b9fe9beba50a640f67534c3812f64d96a1fb8adfdc136dfe730ca2370825cd45b7f87a544d6a58dd868cb5a3a7f42e2789f6d679dbc0fdd52c3
MD5 SHA1 SHA512

Submit Download

memory/396-15-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/396-17-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/396-23-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/396-22-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3456-18-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Download

memory/3456-19-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Download