c1961d28716d42964e3038be86fe7a704017364dc6719eed1cc70e97eed82e3c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe
Size

329KB
MD5

78720d64d670353b2a0786695ffc6bfe
SHA1

e5e182d3b74679187e00268f904cd585cf589953
SHA256

c1961d28716d42964e3038be86fe7a704017364dc6719eed1cc70e97eed82e3c
SHA512

0738ee5fedc7f15908426499d25c84e6d3adc70778c065ce1c7c7b1cd8a7e44ccc0efbde6fe1d634033e210a3a73141890caf03b1c0e7f635e8eeea23410b0cc
SSDEEP

3072:5aVMdmDBnc+FjUwP8pTxdNgocG7TCSNKuboAoe05b7hrMTNO+DsFwI781uwuBR5:sgZs8pTlxcG72SNBbb10Z7oDKP77wM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2128	78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe
2128	78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2128	78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3444	2128	78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe	56
PID 2128 wrote to memory of 3444	2128	78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe	56
PID 2128 wrote to memory of 3444	2128	78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe	56
PID 2128 wrote to memory of 3444	2128	78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe	56
PID 2128 wrote to memory of 3444	2128	78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\78720d64d670353b2a0786695ffc6bfe_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2128-1-0x00000000005C0000-0x00000000005E3000-memory.dmp

Filesize
140KB

Download
memory/2128-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2128-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download