16692abb2f539d74b7334c2ef903b21de41f1fb2107eec8bae2d8e57c224f338

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
Size

19KB
MD5

68884c6db3799319d6e7cd6e3b9431cf
SHA1

f2b8ae45fce4895362ff4b18339de5f9f942ccd7
SHA256

16692abb2f539d74b7334c2ef903b21de41f1fb2107eec8bae2d8e57c224f338
SHA512

4941bc66445d316c59fc9a8fe9482aeab60eff22a11e5d76f5800d80e106aaca6339bbfb6872712ee9b77493e708b320b3ab668b40144674fc6e95987d259bd3
SSDEEP

384:tM2vDSnnNB+Nv2rYD01IOc239d8lxkRKuj2l0Or6rrFILlVeiwAdr8:O2OnnNQNv2UD8IOc6v8lxkRLjo0PrFVP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\videodevice.dll	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gdwdi32.cfg	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gdwdi32.dll	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\gdwdi32.dll	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
648	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
Token: SeDebugPrivilege	4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3464	4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe	56
PID 4944 wrote to memory of 4232	4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe	83
PID 4944 wrote to memory of 4232	4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe	83
PID 4944 wrote to memory of 4232	4944	68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe	83

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Users\Admin\AppData\Local\Temp\68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\68884c6db3799319d6e7cd6e3b9431cf_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\videodevice.dll

Filesize
4KB

MD5
fe9093753c70a2acdcf4eadb6f0b216c

SHA1
8f2c7019086b76966c32f2759fbccd980d672ca7

SHA256
56ee4075ac8e9176c1e55e73d5b5536983cefb82236a0ac860ea98cee00c4d6d

SHA512
3fd94bb5c467b99e894bc6bfa15e1cf1bc4a1cc76ae80f78d63d9c380349b977d2780dbb44bc600211740ee52919b398ba3a3ed86a115bd9d825b2d5406afda6

Download Submit
memory/4944-0-0x00000000001C0000-0x0000000000200000-memory.dmp

Filesize
256KB

Download
memory/4944-4-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4944-9-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4944-10-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download