03b393f0246a5428f15fa97b1a785f19e0b8ff3d98038008510acb322611acad

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a89351bf3f513bb255fdb20eb030116_JaffaCakes118.exe
Size

3KB
MD5

8a89351bf3f513bb255fdb20eb030116
SHA1

b0bd5f479025c8742f6b8811b33f8da9c77359c8
SHA256

03b393f0246a5428f15fa97b1a785f19e0b8ff3d98038008510acb322611acad
SHA512

dd540b2836fbbb8c32ddbdd72b57453549d87be4d6f3f8f21e302aff5780f37f702a0233a74eeae12b80205d3675aa82c3c85f4b63dfc02e5f9ac20d58f69491

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xslfdl.bat	8a89351bf3f513bb255fdb20eb030116_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a89351bf3f513bb255fdb20eb030116_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1600	548	8a89351bf3f513bb255fdb20eb030116_JaffaCakes118.exe	97
PID 548 wrote to memory of 1600	548	8a89351bf3f513bb255fdb20eb030116_JaffaCakes118.exe	97
PID 548 wrote to memory of 1600	548	8a89351bf3f513bb255fdb20eb030116_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\8a89351bf3f513bb255fdb20eb030116_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a89351bf3f513bb255fdb20eb030116_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C C:\Windows\system32\xslfdl.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xslfdl.bat

Filesize
243B

MD5
46c01e16e8b9af0cdf476a6ace700dc2

SHA1
85fbf5cce3cff9af7e7b37e723fbaa67bf26a582

SHA256
269455d4934d046e79ff48e040a3c14dc9942461af91fe5b0ab023011900994f

SHA512
8a6c1dbf908b4620a767ae17adbe55e41ef0f41d640767e854d2fd3e755a8c28d51d84c174a00254a8fb4ce7d063055fda60505d2462e232d5f29108e8e73540

Download Submit