bd547327f3224d2a86be472913e706579e976c5fedc62d2532f9dfa670bb3821

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89c00ec0baa466573907b783055a5958_JaffaCakes118.exe
Size

2.7MB
MD5

89c00ec0baa466573907b783055a5958
SHA1

44b6605b0a44666d5c2267c4f0e29c3f157219e0
SHA256

bd547327f3224d2a86be472913e706579e976c5fedc62d2532f9dfa670bb3821
SHA512

4428a3b80f188cbc4f460d5edc7a801dcbb865a9befb6174fa080af329c331b8af02a58376638deb2ec8ba94328b49aa8b2a19b6569fb1ea775eb9118ac83d7a
SSDEEP

49152:++fqm1p1m26U6SjQwxkEZAIjgTDNgsXpst0tI9nEEl5OibR+iUa3YIrzYIDT0Qec:++f71p1B6U69wyUAIjg7C0REl5OiAiUK

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4984	sexyss86.exe_tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Salma Hayek Sex-E Screensaver Uninstaller.exe	89c00ec0baa466573907b783055a5958_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89c00ec0baa466573907b783055a5958_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sexyss86.exe_tmp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 4984	2648	89c00ec0baa466573907b783055a5958_JaffaCakes118.exe	92
PID 2648 wrote to memory of 4984	2648	89c00ec0baa466573907b783055a5958_JaffaCakes118.exe	92
PID 2648 wrote to memory of 4984	2648	89c00ec0baa466573907b783055a5958_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\89c00ec0baa466573907b783055a5958_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\89c00ec0baa466573907b783055a5958_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\inst240669859\installer\sexyss86.exe_tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\inst240669859\installer\sexyss86.exe_tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4396,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\inst240669859\installer\sexyss86.exe_tmp.exe

Filesize
2.1MB

MD5
874a816f8314acbb8550f807063330fc

SHA1
d431f9aca197b6fceb03652e0728ec881baaa754

SHA256
7bf136c640888cfa315c4970d7decc2a519c9b1e8e9110c5ed2164be071e6b93

SHA512
8e23549b92a49b59250142b23da491feedaef0eeb2b9788a3e88ee85a9dfa16931340d74ed3d177e112295b301bab5f43a39c4bf6a6a28d7b585f622c5e72b47

Download Submit