1b962ea52d56d3e2b3cf54f05b755cfa4c1b625eb1c4757b4af8a7693c0b27b3

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68a335af0ee6edfddb423c1b5f589a20_JaffaCakes118.exe
Size

111KB
MD5

68a335af0ee6edfddb423c1b5f589a20
SHA1

9b08d8fa455b55b9746f9fec1dc3a57dd2c6e57e
SHA256

1b962ea52d56d3e2b3cf54f05b755cfa4c1b625eb1c4757b4af8a7693c0b27b3
SHA512

d385c570afa878705b1b73046a6d5f3839d05708e7fd6ead3d6d09921400270c379916ce4f7381514d265b1074360745ad0bfaa1428be3014c61d61bf4799301
SSDEEP

3072:TGu99lfzqIbXWm+w0JP5D/PhZkhQ2TPE:T/cuo9BZ2T

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4684	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	68a335af0ee6edfddb423c1b5f589a20_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68a335af0ee6edfddb423c1b5f589a20_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4684	server.exe
4684	server.exe
4684	server.exe
4684	server.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 4684	2460	68a335af0ee6edfddb423c1b5f589a20_JaffaCakes118.exe	84
PID 2460 wrote to memory of 4684	2460	68a335af0ee6edfddb423c1b5f589a20_JaffaCakes118.exe	84
PID 2460 wrote to memory of 4684	2460	68a335af0ee6edfddb423c1b5f589a20_JaffaCakes118.exe	84
PID 4684 wrote to memory of 3532	4684	server.exe	56
PID 4684 wrote to memory of 3532	4684	server.exe	56
PID 4684 wrote to memory of 3532	4684	server.exe	56
PID 4684 wrote to memory of 3532	4684	server.exe	56
PID 4684 wrote to memory of 3532	4684	server.exe	56
PID 4684 wrote to memory of 3532	4684	server.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3532
- C:\Users\Admin\AppData\Local\Temp\68a335af0ee6edfddb423c1b5f589a20_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\68a335af0ee6edfddb423c1b5f589a20_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
48KB

MD5
327c7ddee5dd615ce6399f7b463666fd

SHA1
6c2a6242068260665b9b910198d3619115f209f5

SHA256
025d9822eae357b1779f61a3e20545fed44d3b56f1f061c6180e0c4496529e54

SHA512
b7e06e33294ca48d27247fece5d9faab658f12e2817f5978097f171e493c3de0389be7718015039faf103cbed8c6c2bda04567eaf87d8923b57e0e39785e27e7

Download Submit
memory/2460-0-0x0000000001000000-0x0000000001030000-memory.dmp

Filesize
192KB

Download
memory/2460-1-0x0000000001001000-0x0000000001002000-memory.dmp

Filesize
4KB

Download
memory/2460-19-0x0000000001000000-0x0000000001030000-memory.dmp

Filesize
192KB

Download
memory/3532-11-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/3532-13-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download
memory/4684-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4684-9-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4684-8-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4684-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4684-18-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download