a72891ad84b8ebeaa4ae17bb5d84602c24104b9db634d97aa777a2bdc661f642

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70f9f1662d6e6f606be42e1eb3e967ea_JaffaCakes118.exe
Size

44KB
MD5

70f9f1662d6e6f606be42e1eb3e967ea
SHA1

9afd13440757732c99c3d0ecfec59c11ae4aae53
SHA256

a72891ad84b8ebeaa4ae17bb5d84602c24104b9db634d97aa777a2bdc661f642
SHA512

1f6efbd421bc49203e194e3b4a6aac7b21a3307ccd65f35ed3fc3fc554d7c063d26e9152210755e94536bfd4da84c7a56dbc3d6758045dcc2fb7bf797b83de08
SSDEEP

768:wc+ceWdva7R8FWUNa/pja6dTj3nCkuOVyXxauh7G0BhdQ6wukN53Gl:wseMa7aFWka/pja6dTrPuz0uh75M7r

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43545357-3350-2E32-7865-336D65747379}	70f9f1662d6e6f606be42e1eb3e967ea_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43545357-3350-2E32-7865-336D65747379}\StubPath = "C:\\Windows\\system32\\WSTCP32.exe"	70f9f1662d6e6f606be42e1eb3e967ea_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WSTCP32.exe	70f9f1662d6e6f606be42e1eb3e967ea_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70f9f1662d6e6f606be42e1eb3e967ea_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4668	70f9f1662d6e6f606be42e1eb3e967ea_JaffaCakes118.exe
4668	70f9f1662d6e6f606be42e1eb3e967ea_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\70f9f1662d6e6f606be42e1eb3e967ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70f9f1662d6e6f606be42e1eb3e967ea_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4668-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4668-2-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download