726557246d1615103b842067b98583e645ee517feb2a072bbd2512866ace1ced

Analysis

max time kernel
104s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_96f2ead05c2101f4102681b8a862579f.exe
Size

248KB
MD5

96f2ead05c2101f4102681b8a862579f
SHA1

2222e996c4a5c4d45a08a8a94ed3ba2a43b8f4e4
SHA256

726557246d1615103b842067b98583e645ee517feb2a072bbd2512866ace1ced
SHA512

de97ab5ea9ae9d49fb75a41ae5f752bb962e16bae142ac19f85d4028c271edd650e97e4ca19d7b40c9f6a0ce2b94d6ba1e4709069dc7613b63b3c950546bef1c
SSDEEP

3072:YGKROS5fkMLalsplF9YxKROS5fkMT9S+tERxm0D9:lKRlfdLQsZ8KRlfdDeD9

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	JaffaCakes118_96f2ead05c2101f4102681b8a862579f.exe

Executes dropped EXE 1 IoCs

pid	Process
3188	Zehir.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3188	Zehir.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3188	Zehir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 3188	556	JaffaCakes118_96f2ead05c2101f4102681b8a862579f.exe	88
PID 556 wrote to memory of 3188	556	JaffaCakes118_96f2ead05c2101f4102681b8a862579f.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96f2ead05c2101f4102681b8a862579f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96f2ead05c2101f4102681b8a862579f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:556
- C:\Root\Zehir.exe
  "C:\Root\Zehir.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Root\Zehir.exe

Filesize
50KB

MD5
d3a525c23941381963965b880c471eb0

SHA1
e55828db7644918980f8758e6cd8076a657273fe

SHA256
10232b739fa0ed45879f29edd52e448e7577520e85fb7d0bc2e125390b35bfdf

SHA512
a87b427a29cbfde0f08138d40c9ce560f1cbca8c13feb369da9ce7a90635a551ad0fba3394b1ad0733847a973ae9da3ad9d0389b2df2fab5dc39b9e76b2fd2e4

Download Submit
memory/556-22-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/556-1-0x000000001B680000-0x000000001B726000-memory.dmp

Filesize
664KB

Download
memory/556-3-0x000000001BC00000-0x000000001C0CE000-memory.dmp

Filesize
4.8MB

Download
memory/556-2-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/556-4-0x000000001C1D0000-0x000000001C26C000-memory.dmp

Filesize
624KB

Download
memory/556-5-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/556-6-0x0000000000F70000-0x0000000000F78000-memory.dmp

Filesize
32KB

Download
memory/556-7-0x000000001C330000-0x000000001C37C000-memory.dmp

Filesize
304KB

Download
memory/556-8-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/556-0-0x00007FFD30B05000-0x00007FFD30B06000-memory.dmp

Filesize
4KB

Download
memory/3188-21-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-23-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-24-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-25-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-26-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-27-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-28-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-29-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-30-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-31-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-32-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download
memory/3188-33-0x00007FFD30850000-0x00007FFD311F1000-memory.dmp

Filesize
9.6MB

Download