a18cf94fa7404427a3587a12401247588203fd8fefe82c2ad5c9e796a8aa911d

Analysis

max time kernel
140s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.exe
Size

3.0MB
MD5

81c688c65a97deceada9c671d3df6dfd
SHA1

218b50398f9d18c6d8d19c9b0a881b001eb82827
SHA256

a18cf94fa7404427a3587a12401247588203fd8fefe82c2ad5c9e796a8aa911d
SHA512

f2c0273e24ef53d82dc82015eba3df60a14c822cde636b770c08f30d24815cd2daf9e6d91001a396379c2f2d6563b261bb90d6daf9320031003589f19cfd26c1
SSDEEP

49152:qa9EGEPc+ISjWcJGssRhszyAEt+aumSlgGBzVTF+cGRxOCn1wC+g8db/5IBuJ+Ue:D9EGEQphDRhszTEt+aujgOv+cGRYqF+W

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
616	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.tmp

Loads dropped DLL 3 IoCs

pid	Process
616	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.tmp
616	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.tmp
616	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
616	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.tmp
616	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 616	4504	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.exe	85
PID 4504 wrote to memory of 616	4504	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.exe	85
PID 4504 wrote to memory of 616	4504	81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\is-JK2A3.tmp\81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JK2A3.tmp\81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.tmp" /SL5="$502A8,2730170,77312,C:\Users\Admin\AppData\Local\Temp\81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-ELAOT.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ELAOT.tmp\psvince.dll

Filesize
36KB

MD5
a4e5c512b047a6d9dc38549161cac4de

SHA1
49d3e74f9604a6c61cda04ccc6d3cda87e280dfb

SHA256
c7f1e7e866834d9024f97c2b145c09d106e447e8abd65a10a1732116d178e44e

SHA512
2edb8a492b8369d56dda735a652c9e08539a5c4709a794efaff91adcae192a636d0545725af16cf8c31b275b34c2f19e4b019b57fb9050b99de65a4c08e3eee1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-JK2A3.tmp\81c688c65a97deceada9c671d3df6dfd_JaffaCakes118.tmp

Filesize
710KB

MD5
02af54d9e8f925a10e2fbdd119e4c8d2

SHA1
0457bb1f89d2596266634d5ae792257086caf662

SHA256
53dbf2debbb7811846feba931a246ec87cb1e614389760b40b5ac0255eac04a7

SHA512
25c05a8be8cd14981fdbc6d5f3e729aa0fa6b05e2500c38d2f935c2cec828da65bc9ac01cc6c11b0a3fb917321534b99f2007851658370594282cf2377084438

Download Submit
memory/616-7-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/616-17-0x0000000003A40000-0x0000000003A7C000-memory.dmp

Filesize
240KB

Download
memory/616-27-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/616-28-0x0000000003A40000-0x0000000003A7C000-memory.dmp

Filesize
240KB

Download
memory/4504-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4504-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4504-26-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download