c8b25d1620e03b3c433f2f8b07f53b398c7c7183efad7b869f917b4bb49976ca

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe
Size

88KB
MD5

94870f8f51f8ba88a9b742d1d1e137c5
SHA1

cd9121a6305255bfb0b47dfe12a5e0b00b335a92
SHA256

c8b25d1620e03b3c433f2f8b07f53b398c7c7183efad7b869f917b4bb49976ca
SHA512

a02ad3a5484d85e31359acd40151584b4b661217997d6e932c320da88d747b46c84db3c0d32bd9de54e029aecebe880838b5fb993c95a9e2f68425c6363f3399
SSDEEP

1536:/U2fHKylNO6Cblg7yQX/HS5swL+UR71wipFBFKH9LPgCGF/W31kBoFHn:82P3O0K5fjl1wyFBFSLPg+Me

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5100	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 3508	5100	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe	96
PID 5100 wrote to memory of 3508	5100	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe	96
PID 5100 wrote to memory of 3508	5100	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe	96
PID 3508 wrote to memory of 208	3508	cmd.exe	98
PID 3508 wrote to memory of 208	3508	cmd.exe	98
PID 3508 wrote to memory of 208	3508	cmd.exe	98

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
208	attrib.exe

C:\Users\Admin\AppData\Local\Temp\94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sxhtrllj.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\attrib.exe
    attrib -r -s -h "94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bwdzrysa.dll

Filesize
42KB

MD5
64abd1881f5bc0972d49787e6ca75ea0

SHA1
0bdcb49f6f130a6053014b93f88d1f2cf84c4466

SHA256
692cd2ca18c800a5a9069cbe3bb630a1d53610897b60d4e4acf75ef559d8ce79

SHA512
fba3e9d87be31123d10ad43ca43e2800a3a6a33e692833976b98df9928ab3b43b400d127fd185c7ae812243930a2932140dffa649d2093948799e7d1f2c4374f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxhtrllj.bat

Filesize
238B

MD5
8648e9d282b1ad9268bcdc3635384380

SHA1
eb1199d57863a41f08225e293ae864b27d46774f

SHA256
771e3193ff9bb52665017d6f8c5835b0fd62dc1b0d838b261a932da400ba754a

SHA512
18036e863cc389d99cd5f3efd8a77a748c9afffe8bbd2f818652f931535840fc997a616bdb6fbb3b9a41b7d8f9e6e9cfbf5fa4f113c241edbd9779c35d97192f

Download Submit
memory/5100-0-0x0000000000720000-0x0000000000730000-memory.dmp

Filesize
64KB

Download
memory/5100-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5100-9-0x00000000000D0000-0x00000000001D0000-memory.dmp

Filesize
1024KB

Download
memory/5100-8-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5100-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5100-11-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5100-14-0x0000000000720000-0x0000000000730000-memory.dmp

Filesize
64KB

Download
memory/5100-15-0x00000000000D0000-0x00000000001D0000-memory.dmp

Filesize
1024KB

Download