5852e0b1479d914e16a2f1cf21d61ff4e1f3d35b6fa5dbcf0055cfc2c9a89936

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-08-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe
Size

256KB
MD5

9b8f96489ef491a4378ae2552ee9950f
SHA1

276b5857cd4b0b4289660efa6751821df93f374f
SHA256

5852e0b1479d914e16a2f1cf21d61ff4e1f3d35b6fa5dbcf0055cfc2c9a89936
SHA512

7bd616157ae2c8021434937438fbcff60c139aafbb31f8c9b431925ecc2543af16216236557ba32360c784a6a65ef86f1e59b5a2fba47602035b9569731eac9a
SSDEEP

6144:F8LxBsMM0ev4yAs/lCDDtCupqxt9smUMHoeE/ZRPCb3tk:/lQuq14xghR4dk

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

pid	Process
4928	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4928 wrote to memory of 4416	4928	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	87
PID 4928 wrote to memory of 4416	4928	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	87
PID 4928 wrote to memory of 4416	4928	9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9b8f96489ef491a4378ae2552ee9950f_JaffaCakes118.exe"
  2⤵
  PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsb7BE8.tmp\vksn.dll

Filesize
20KB

MD5
e34c52bba24db2908916801f8e39b7a7

SHA1
d58cf73e0993109a2cd0a07c980682337186385b

SHA256
e203779a905288614ca814693eaf5841c2213ca6c9f2e6d127accbaf69e84c32

SHA512
0e5abbc376c252936fb9ae149d000aa15b971d3e49b8f224a3789750f9ccbd1d399ceec28318e4e34d00577ed4140baba6fbdb8c57f33f6fc43131bd2c036436

Download Submit
memory/4928-5-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download