3e2cdc03153569fe98cad382e34ed6a73b5890999a50675878c51696b42b9496

Analysis

max time kernel
95s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe
Size

6KB
MD5

a408ce661f2c481c37047e8726a106be
SHA1

e31769c0804983aaea87561a891bcfcab55e42da
SHA256

3e2cdc03153569fe98cad382e34ed6a73b5890999a50675878c51696b42b9496
SHA512

4570ee23bded3ed937c2294a7c15da836f7ba2695c12bd1076bdb48d2c80e0b7d31b20f949b7dfe9c65ef0b567ba32a68fe04ccab645cbccafeb07bd40192a98
SSDEEP

96:uED1cyf44yWShX1lQmjDGdHaYh3zqmmDCR7GjwrV1aTap:mCHmdZjDGdHbhPgjwqap

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SCANREG01.REG	a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe
File created	C:\WINDOWS\WINSTART.CMD	a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REGEDIT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3480	REGEDIT.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5084	a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3480	5084	a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe	96
PID 5084 wrote to memory of 3480	5084	a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe	96
PID 5084 wrote to memory of 3480	5084	a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe	96
PID 5084 wrote to memory of 4164	5084	a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe	97
PID 5084 wrote to memory of 4164	5084	a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe	97
PID 5084 wrote to memory of 4164	5084	a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a408ce661f2c481c37047e8726a106be_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\REGEDIT.exe
  REGEDIT /S C:\WINDOWS\SCANREG01.REG
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:3480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\WINSTART.CMD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VNN58CU3\details[2].htm

Filesize
67KB

MD5
891a8547e825d496b417679ede379fec

SHA1
46556e2eb69f0b8efdd96f0aa2f503b50adf93e2

SHA256
42b34f237004a35917030f994fef36cd5096f18ffae65b3704678f17c446be0f

SHA512
963b9a5b597ecf3c45702f5644516879f3e8fe89654c7490f144bad341446cc7cf36e0c1815e347759143a45844e847986ba79fcb8ef88c21079b8b8b18f8ec9

Download Submit
C:\Windows\SCANREG01.REG

Filesize
67KB

MD5
9b9ccbb1942e666838604de1518b7b8d

SHA1
4f95e68c94acf4669cdd14941b5d33076e809691

SHA256
3fd733bcb4ea5702f526f59b5257e454c85d90b317e0b49815a10dd9fc1f47f8

SHA512
0b28992833c33d02f28e70d0a5d1ce1e902c683ddf0e6558f79a1fc64f811d4af7d8075a4cd5742e623dae3a36035f08bf7dc63fd49a0de34352dbcb3cef4e22

Download Submit