dcb4d92c8d7fc80b8d1c89e90ecfca12894afdbd62258f4789e2614a417d22c7

Analysis

max time kernel
140s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.exe
Size

15.3MB
MD5

b56b1a986579793cc6f15310fac9dbb9
SHA1

1de550ba75903666807ae17ac7050a70769daed6
SHA256

dcb4d92c8d7fc80b8d1c89e90ecfca12894afdbd62258f4789e2614a417d22c7
SHA512

29b09e55e5694183d0be30ee4f6b1bc821acd19080898d89f0fcf7ccb5ce8c9265a4cd864d6609ef3734403d41291a69e3188c4173ce85414e3afd11069f809a
SSDEEP

393216:CbnU6UHNJlPIE7QpLUmizyIZz4qJMBt9CZASvf:CDelgl+XyIB4qJMbuf

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1328	b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.tmp

Loads dropped DLL 3 IoCs

pid	Process
1328	b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.tmp
1328	b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.tmp
1328	b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.tmp

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1560	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 1328	3976	b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.exe	85
PID 3976 wrote to memory of 1328	3976	b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.exe	85
PID 3976 wrote to memory of 1328	3976	b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\AppData\Local\Temp\is-OINC5.tmp\b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OINC5.tmp\b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.tmp" /SL5="$6029C,15363318,58880,C:\Users\Admin\AppData\Local\Temp\b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1328

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x348 0x4e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-4DNN5.tmp\AdvSplash.dll

Filesize
6KB

MD5
4d80f91a57beb72ce964492278383648

SHA1
92b414599f999187b368aef8792967c4ac4f9980

SHA256
9a21350f691ad4ad99950d386aa887c4120f733578b594bad16afbc1cd1214f7

SHA512
01d579865b18cae9fd76a85bdb3dc5643af0ec31b5e1a83c4fe52cf15c5b0ca3ca6115f3f77ffaff10da848a666d2ca97abe10242b4ea1885f412f2d4d1d0585

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4DNN5.tmp\callnsis.dll

Filesize
17KB

MD5
6f40c620fb50c646a5d282dc0b87d7b0

SHA1
230ab758124e28d8c74f1578ce5eda9e830db1f2

SHA256
cda9d2a7baef4796844a229d01585daf7ed84bc12e51166b72f28cc2b0be1181

SHA512
7f385a86fbf503afa4a285d053f92d4a155a28c1c6eb26d93fe6104e55e74d2f9a4399adbac314cbc3792314f94360146e9fe947bc4645426705fb71752c99fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OINC5.tmp\b56b1a986579793cc6f15310fac9dbb9_JaffaCakes118.tmp

Filesize
688KB

MD5
bba70d4ed1f3419d52c63c4f85e8aadb

SHA1
a9d4b5ce321cfc221ca546fc15cf330b65590ad6

SHA256
1d244504dcb129c16d91113eee7a35f8807cd9af3e1adebc85c2b9addabc2e40

SHA512
800d55a5ebfbf6d3dff9c3d54b14f7f7cb0671b520eaf2c4c2731fa98e6a96e6a5fc30a93f28b41282b03ddbb2667f08f133afc84c4e49e621656f79510cbd41

Download Submit
memory/1328-12-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1328-33-0x00000000023D0000-0x00000000023DB000-memory.dmp

Filesize
44KB

Download
memory/1328-32-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3976-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3976-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3976-31-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download