e88732dca879d28e67765f4726db3cd4cfea5429fa1ecef87f3b5adcec34aac7

Analysis

max time kernel
69s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe
Size

91KB
MD5

a13ee86fa4b55e90223066f5dca43ff6
SHA1

399999b2cb5539dbb87b7bf40c2c460b7a1578a6
SHA256

e88732dca879d28e67765f4726db3cd4cfea5429fa1ecef87f3b5adcec34aac7
SHA512

184c7a582e717639220f489b3b7e5a87e7d96b6e856a1e1edb0fd8ea3c075181ca7305155226b0a67f76ae88bf57ac78b930fdf1aaf051d8ca5edc96e3003f11
SSDEEP

1536:pp1rLwUCpU1PdOc6izl9edX85l/rcyBj6UUR7GOn3GBz6sCI7FGKqNSTOnMM4:pp1YUCpU1PdOcRCdglG55GBcGGKqNS6F

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Winswz.exe	a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Winswz.exe	a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2912	a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe
2912	a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 616	2912	a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe	5
PID 2912 wrote to memory of 1880	2912	a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe	93
PID 2912 wrote to memory of 1880	2912	a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe	93
PID 2912 wrote to memory of 1880	2912	a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe	93

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Users\Admin\AppData\Local\Temp\a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a13ee86fa4b55e90223066f5dca43ff6_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\127.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\127.bat

Filesize
219B

MD5
21a8c537a0fe4880627dfa05c844474b

SHA1
723067328c55bbd0ce5dd9ec82fce698e9643aa5

SHA256
3acce0373f83cb5cc336a57472ccf7172287197dbcd6d8163846fdf1d27ec9d5

SHA512
724c99dcf6769e3fac43ced3ec68d5679834aa6474fee32b53e4506d69721fbad054eeb1a2d94566fd5448edd9612828e7b6f4b7a945c68a7ac45dce9bc6774f

Download Submit
memory/2912-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download