5a8726d894293d55e16c15c6782c9e9c3cb7e5539ac37a50719c6592988bcf21

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
Size

177KB
MD5

86a228cae29394f7af03f938b92a7d31
SHA1

c9ab28ce4be495d29a6140f4f9af4c874b7307ec
SHA256

5a8726d894293d55e16c15c6782c9e9c3cb7e5539ac37a50719c6592988bcf21
SHA512

b84e77e87087b00f27ca7a58b51150af8cbe98a2c953039eb00660ddb2ce488a82f0ccded8ff46411c6006420c7ceb25ee29a4ab5dd8cb4cbc354c13ccf62790
SSDEEP

3072:C5n0F0bMtKlwi8JrpcXxKmW9Tdv2+QhPMGyvzT4DmDer4Oe5Sni:yn06b2iFXCZC4T4DmDer4

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe\""	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\86a228cae29394f7af03f938b92a7d31_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/388-1-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/388-2-0x00000000004D0000-0x00000000004F3000-memory.dmp

Filesize
140KB

Download
memory/388-4-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/388-3-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download
memory/388-5-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/388-7-0x00000000004D0000-0x00000000004F3000-memory.dmp

Filesize
140KB

Download
memory/388-8-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download
memory/388-9-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download