5852e0b1479d914e16a2f1cf21d61ff4e1f3d35b6fa5dbcf0055cfc2c9a89936

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe
Size 256KB
Sample240815-zm8q2stdmh
SHA256 5852e0b1479d914e16a2f1cf21d61ff4e1f3d35b6fa5dbcf0055cfc2c9a89936
MD5 9b8f96489ef491a4378ae2552ee9950f
SHA1 276b5857cd4b0b4289660efa6751821df93f374f
SHA512 7bd616157ae2c8021434937438fbcff60c139aafbb31f8c9b431925ecc2543af16216236557ba32360c784a6a65ef86f1e59b5a2fba47602035b9569731eac9a
SSDEEP 6144:F8LxBsMM0ev4yAs/lCDDtCupqxt9smUMHoeE/ZRPCb3tk:/lQuq14xghR4dk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4928	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4416	4928	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	87
PID 4928 wrote to memory of 4416	4928	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	87
PID 4928 wrote to memory of 4416	4928	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe"
  2⤵
  PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vksn.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb7BE8.tmp\vksn.dll
Size 20KB
SHA256 e203779a905288614ca814693eaf5841c2213ca6c9f2e6d127accbaf69e84c32
MD5 e34c52bba24db2908916801f8e39b7a7
SHA1 d58cf73e0993109a2cd0a07c980682337186385b
SHA512 0e5abbc376c252936fb9ae149d000aa15b971d3e49b8f224a3789750f9ccbd1d399ceec28318e4e34d00577ed4140baba6fbdb8c57f33f6fc43131bd2c036436
SSDEEP 384:bmgOuiCzcXBWIOrJ0mLQrVTqyYVP74ovLwZRNngH8QvlN:bvOuiCzOX6cpjYVP7/z4Nw7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4928-5-0x0000000010000000-0x0000000010009000-memory.dmp

Download