872483dd619b4ba4f2b70d1a2ebaae51f071557ca6f46e7d65bc09bfb657b62f

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aaf89802adf21599d871a7180af8aa0b_JaffaCakes118.exe
Size

240KB
MD5

aaf89802adf21599d871a7180af8aa0b
SHA1

2102b7bf7c85a1aadc0df72b90012269db2a2919
SHA256

872483dd619b4ba4f2b70d1a2ebaae51f071557ca6f46e7d65bc09bfb657b62f
SHA512

54cd9a85f02f1712bf41a48226af9cc9e497d38f3db17bbc31a7b2d364adda7c5e7c0ab4f577227f829534f6b281a2e0c89842cc664b8412cc9fc5a89d08bed8
SSDEEP

3072:Xp2flgE/H3RyLh/NjZNYjv9k36DbkQCvTYyr49G+afYD5DJAYk63mLgWTf/X:asYjv9U11TYyr49G+autmLTf/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1368	ryf.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaf89802adf21599d871a7180af8aa0b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ryf.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF604EFE-8897-11D1-B944-00A0C90312E1}\InProcServer32\	ryf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2184	aaf89802adf21599d871a7180af8aa0b_JaffaCakes118.exe
1368	ryf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1368	2184	aaf89802adf21599d871a7180af8aa0b_JaffaCakes118.exe	83
PID 2184 wrote to memory of 1368	2184	aaf89802adf21599d871a7180af8aa0b_JaffaCakes118.exe	83
PID 2184 wrote to memory of 1368	2184	aaf89802adf21599d871a7180af8aa0b_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\aaf89802adf21599d871a7180af8aa0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aaf89802adf21599d871a7180af8aa0b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\ryf.exe
  "C:\Users\Admin\AppData\Local\Temp\ryf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ryf.exe

Filesize
20KB

MD5
c881d6bae451f85141db1c5e075e4e4f

SHA1
aa6fb5d8938d1fc251eb7d25a051b0f5c8ea9f0c

SHA256
212fc90ce1492639aec07e4c0b81f7fa82c72779091b6effd08ead6e7509b80a

SHA512
65987e63da799d57f49e232757f3c42482cdbf41a25eec423257a0ae84efbc18be11a8ecbcacdb1b92595d95162df912c7ce36fa42d3b0925d42fa6866e83c8b

Download Submit