427bbb88d726b6dbc5eebff235f17a4d1f1a1b0a205891f94819b85cf99f1aac

Analysis

max time kernel
135s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac307360905b6b4e3959b063aa890b71_JaffaCakes118.exe
Size

297KB
MD5

ac307360905b6b4e3959b063aa890b71
SHA1

a1d765f5b41098dc37f2d1e612bd1d1a1bc7ceb6
SHA256

427bbb88d726b6dbc5eebff235f17a4d1f1a1b0a205891f94819b85cf99f1aac
SHA512

8919d55ebb3bd3497e23e623b103e3ff2f521f23215b07b6fd6196343fd51885e527cb3714d3d5b45f43411f4d22f271869b969a267cd592603097b49fa2dc0b
SSDEEP

6144:/qIQgfbdO0OgU++QWl8hjxizxhVIzxgTRYDgAbpbVDRRhHp7xnj0p:/XdODBbl8c3uz24g0pRDRvHp7S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4848	sxeBFF6.tmp

Loads dropped DLL 2 IoCs

pid	Process
836	ac307360905b6b4e3959b063aa890b71_JaffaCakes118.exe
836	ac307360905b6b4e3959b063aa890b71_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac307360905b6b4e3959b063aa890b71_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sxeBFF6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 4848	836	ac307360905b6b4e3959b063aa890b71_JaffaCakes118.exe	85
PID 836 wrote to memory of 4848	836	ac307360905b6b4e3959b063aa890b71_JaffaCakes118.exe	85
PID 836 wrote to memory of 4848	836	ac307360905b6b4e3959b063aa890b71_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\ac307360905b6b4e3959b063aa890b71_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac307360905b6b4e3959b063aa890b71_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\sxeBFF6.tmp
  "C:\Users\Admin\AppData\Local\Temp\sxeBFF6.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sxeBFE5.tmp

Filesize
15KB

MD5
bd815b61f9948f93aface4033fbb4423

SHA1
b5391484009b39053fc8b1bba63d444969bafcfa

SHA256
b018bf9e9f8b6d945e6a2a25984970634884afabc580af2b4e855730520d5d76

SHA512
a363abe97b5a44e5d36af859e8d484daffe1d8e321c87969a75d1bfaa4288a5e6be1922a02c6d72937c84e81a79a1c7f6c9f2a44a995cac3f993ed5608afcd71

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxeBFF6.tmp

Filesize
792KB

MD5
7fca666b7bff84b5afe77d57dea78be7

SHA1
8ab98485765e78d88c3a1ea8de6d911ae06dcb65

SHA256
c9f7faa9020136ae0761837540e237dcab71fae6ff59acac847ea1192212a893

SHA512
bf1e00ba0f91795b37f07d2f39bd0fa31016379c2870c7a4a58be70f038ab5fd869d2ccc4ae1f413c0800b329af83e062f260119d6a80b070e930a15285f745e

Download Submit