55477741c0e16f0ccd746f9126e198420d88b72375043524610008a71ad757c3

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

873b59ebf99048114ffb11c8aa6de44c_JaffaCakes118.exe
Size

236KB
MD5

873b59ebf99048114ffb11c8aa6de44c
SHA1

0230e6c667d802f99b0347171d98146c504955ab
SHA256

55477741c0e16f0ccd746f9126e198420d88b72375043524610008a71ad757c3
SHA512

7093ffc7c3b16d4e6eb101596d022c680a61267fa1fd5c7ff2d7f78a9345751ae08171f770f50897963a7f3dedc99ff267800bf24eaa131fa6d7363eb017594b
SSDEEP

6144:xjNPCiITdbOupRBtHMJDeJKkcPOI7rPVrlAQ3WuY9f:xjNKiItOg3M9tkOB7rrWuYl

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1040	vscgsdgf23.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\vscgsdgf23.exe	873b59ebf99048114ffb11c8aa6de44c_JaffaCakes118.exe
File opened for modification	C:\Windows\vscgsdgf23.exe	873b59ebf99048114ffb11c8aa6de44c_JaffaCakes118.exe
File created	C:\Windows\Delete.bat	873b59ebf99048114ffb11c8aa6de44c_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	873b59ebf99048114ffb11c8aa6de44c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vscgsdgf23.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1040	vscgsdgf23.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2892	4740	873b59ebf99048114ffb11c8aa6de44c_JaffaCakes118.exe	89
PID 4740 wrote to memory of 2892	4740	873b59ebf99048114ffb11c8aa6de44c_JaffaCakes118.exe	89
PID 4740 wrote to memory of 2892	4740	873b59ebf99048114ffb11c8aa6de44c_JaffaCakes118.exe	89
PID 1040 wrote to memory of 1444	1040	vscgsdgf23.exe	88
PID 1040 wrote to memory of 1444	1040	vscgsdgf23.exe	88

C:\Users\Admin\AppData\Local\Temp\873b59ebf99048114ffb11c8aa6de44c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\873b59ebf99048114ffb11c8aa6de44c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Delete.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2892

C:\Windows\vscgsdgf23.exe
C:\Windows\vscgsdgf23.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
214B

MD5
f4894da1e1eada859b026f6d442d8d37

SHA1
4f18aa12ac3e7c3dc2ee8a702311b5b92162261a

SHA256
f9b970714742439af44fcea61fc11970f78a4981b251ac668df880dda9e2f267

SHA512
380a4442dc0676284bc13ecf7ad420017f880d4fe295b0105e97b2b5bdfcc22f48fa2fd9e5a552cca7383811ef393bbe3e03c8767700cee7c5d8075736f21aec

Download Submit
C:\Windows\vscgsdgf23.exe

Filesize
236KB

MD5
873b59ebf99048114ffb11c8aa6de44c

SHA1
0230e6c667d802f99b0347171d98146c504955ab

SHA256
55477741c0e16f0ccd746f9126e198420d88b72375043524610008a71ad757c3

SHA512
7093ffc7c3b16d4e6eb101596d022c680a61267fa1fd5c7ff2d7f78a9345751ae08171f770f50897963a7f3dedc99ff267800bf24eaa131fa6d7363eb017594b

Download Submit
memory/1040-8-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1040-7-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1040-11-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/1040-15-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1040-14-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1040-16-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/4740-0-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4740-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/4740-2-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/4740-12-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download