Analysis
- max time kernel
135s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
19/08/2024, 06:02
Behavioral task
behavioral1
Sample
a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe
- Size 95KB
- Sample240819-grgh9a1drm
- SHA256 8827d0d688816936aca955d6216162a74892d0d721154869ce156c735c7fc0a0
- MD5 a9dd919e91a96ffdd3ad5a8112985d59
- SHA1 8129df2bf9cdb6d05f88732911eb4de8c43a0e5e
- SHA512 1d10b69e3ce074b04b3f236489c7a7645d871860e00b1308d12257726d16a2cb5d867de42c7330b3356ee9ca3fce0b580daf5b2e23e10818f76a7a237b03cf46
- SSDEEP 1536:NO2qAS/1s5HeSk/9v5Wy5/lg81D6qOWH38s9WXD:61KeSm+y5+kD+WX58
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2616-0-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/memory/2616-3-0x0000000010410000-0x0000000010429000-memory.dmp upx behavioral2/memory/2616-2-0x0000000010410000-0x0000000010429000-memory.dmp upx behavioral2/memory/2616-6-0x0000000000400000-0x0000000000419000-memory.dmp upx - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\web\websv.com a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe File opened for modification C:\Windows\web\websv.com a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56 PID 2616 wrote to memory of 3552 2616 a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\a9dd919e91a96ffdd3ad5a8112985d59_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4172
-
-