d93b736ea7c646f26a9fc82db25ae8f4bcf05cfd35bf6905d4932942da8ae476

Analysis

max time kernel
138s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4802842b91acd8772fec521aee3aeed_JaffaCakes118.exe
Size

3.6MB
MD5

a4802842b91acd8772fec521aee3aeed
SHA1

a62b79fd21e371ea15afbf851dcd95b2e69e1867
SHA256

d93b736ea7c646f26a9fc82db25ae8f4bcf05cfd35bf6905d4932942da8ae476
SHA512

dd43ab7bf0ed8dcc912ad7190adacab3f5b4ce5d656723e4f754dd580b5bc7d024cedf9ee9c65b81db2ea726f7f3679d9a15a3f8415ad2ba2e768c8853651a40
SSDEEP

49152:i0c24StiTTsdoNDjoJSFWWCycq1mFDbPd3Zm7BmKGMkO/VcmFJRUZYUxPIakLmEP:i36ivJDiSFdph1mPYAlO/hJ6ZYWwqnE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2856	InstGameInfoHelper.exe

Loads dropped DLL 3 IoCs

pid	Process
3668	a4802842b91acd8772fec521aee3aeed_JaffaCakes118.exe
3668	a4802842b91acd8772fec521aee3aeed_JaffaCakes118.exe
3668	a4802842b91acd8772fec521aee3aeed_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4802842b91acd8772fec521aee3aeed_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstGameInfoHelper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 2856	3668	a4802842b91acd8772fec521aee3aeed_JaffaCakes118.exe	84
PID 3668 wrote to memory of 2856	3668	a4802842b91acd8772fec521aee3aeed_JaffaCakes118.exe	84
PID 3668 wrote to memory of 2856	3668	a4802842b91acd8772fec521aee3aeed_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\a4802842b91acd8772fec521aee3aeed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4802842b91acd8772fec521aee3aeed_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\nsx9A5C.tmp\InstGameInfoHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nsx9A5C.tmp\InstGameInfoHelper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsx9A5C.tmp\InstGameInfoHelper.exe

Filesize
99KB

MD5
3d3d2bf9c42dbdf97247775c00f22190

SHA1
7a046170aaeb5e1a29d8c8cd7c32225f49237aa1

SHA256
59f09ba2c79a209008e76d0478bb691a9fdb2180d84318d9fc73b10401aa853a

SHA512
6e66c4ff467e286cd5dc1d4ccd412fec32cfd01514db6c339fd275eaab5f3b549e223e9330bc61ff19048df70b81b66dfcc78ac351aa2c5ff45cf8d197140466

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx9A5C.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx9A5C.tmp\ftdownload.dat

Filesize
512B

MD5
28c1ac550c09a03dfd2a7b95c624ab0b

SHA1
b800420329c92a0fe6310f1ee429fde43eb38e85

SHA256
b1a130b71dcc388ef3ef865ce94b7479e07e92a0ec5363319296ab5cf1ae36a5

SHA512
6dd3859ab13e5b97572e4bdff67030220d8e6a2bd45d8d83917c5b774842f8d399f8323bb7852293142723ef2b72b65e873b2cf12976cf9b42d601c9b1fa3afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx9A5C.tmp\gametitle.txt

Filesize
24B

MD5
91bbf79dd26c5ab6a2f8fac8db58beac

SHA1
cc8f5755e22637f90f865b9993c691a7caa57111

SHA256
34d6f1744136113a6386060fc34f0b58cbd48232282ac77f434df4d8f23e1682

SHA512
3b24325f676724c99ba0d81c5e2029a5db297853929d7b1ae3a1a2ba496177f83daa6e361b32309a75781ac73850d43a333c97e944db5a8b28ef487b0a20efce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx9A5C.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx9A5C.tmp\tn_feat.bmp

Filesize
4KB

MD5
aaeff1442865fbdb5a19b15018ab5b8a

SHA1
a22773696b615cfb4ceb06f1b441696bef2fd49c

SHA256
6da8cc04ec6c41c072e534d4e0b49ff82ece30eab2097a77fb055e135a44cc2a

SHA512
b7a2e3009cf4cbe6974d4cd652943e4fbbd432299510f5465a5900851b5031d8a6034d2698be43c9a5da601d661f2c21dd89a42bc2ad4d464db6ab32f15cf0cf

Download Submit