079f24b62c8883b1e9cdf061b88e6615e5dc7d0586cea971b34b09e6222e0301

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad074e5b04c23527063b413c08465ac0_JaffaCakes118.exe
Size

16KB
MD5

ad074e5b04c23527063b413c08465ac0
SHA1

768de2f74b3493644d34f27c768d48a9f4e81b2d
SHA256

079f24b62c8883b1e9cdf061b88e6615e5dc7d0586cea971b34b09e6222e0301
SHA512

b433c622637471f9d7501540c7285c74be83c58ccc0df6f8b070bbacd9cb10268f6862f74a15df8640d59d11a1cadb543fe418842d19131653729c3b9981ad7b
SSDEEP

384:ORGww/Qy7OfEKJRHcUfaQbeUskoigFZipCtp:ORtU7OfBJRJaQbvsbI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad074e5b04c23527063b413c08465ac0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4708	ad074e5b04c23527063b413c08465ac0_JaffaCakes118.exe
4708	ad074e5b04c23527063b413c08465ac0_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	ad074e5b04c23527063b413c08465ac0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3388	4708	ad074e5b04c23527063b413c08465ac0_JaffaCakes118.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3388
- C:\Users\Admin\AppData\Local\Temp\ad074e5b04c23527063b413c08465ac0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ad074e5b04c23527063b413c08465ac0_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KQ3665LB\showthread[1].htm

Filesize
9KB

MD5
1e9c357c9dc5a823c31225dc5569084f

SHA1
b518dcd8ea8178dc66809f845bf806ded9babd0b

SHA256
5aeb6a7793fb1d407b92fd2cabe7de0f229dc8f17fed7fb1ad3f65d9222995bc

SHA512
cbef1a5b773fab6c179450611904e9a84e09c44f8b50ec3ea728a86df8f1f9615a3789ac22ec851314ecfb7afdb217d37563a26cbd68c5cdb052dde4160d8a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#3FE6.tmp

Filesize
9KB

MD5
57b8c8b96653e5bf4128af3e35416c4a

SHA1
ada5b6ddb8b4aaae1a9191c8942faa0cd1d8bdda

SHA256
3d8ae5a31023e17c97907a3c0c9abd02bb87f1078b9cc9ffc38560da660ce1a6

SHA512
bb449778358267d12b731d169478a13c54a2a9b69df5ff1ff3236f317a10666bf99254d720b308507ba96bc68b699b4c9ab0c75c22e4eb54f21f9cef52bf0088

Download Submit
memory/4708-0-0x0000000000540000-0x0000000000542000-memory.dmp

Filesize
8KB

Download
memory/4708-1-0x0000000000540000-0x0000000000542000-memory.dmp

Filesize
8KB

Download