74d1eff84e7c043b96e2694cd9c4aab19b377d858f281b54ace68e1a1a2e95de

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118.exe
Size

3.6MB
MD5

b1a93a43d827c25d075e016bf411d7f6
SHA1

6242d3e8e9e7be06a978e5264a68d68e9e11d2ac
SHA256

74d1eff84e7c043b96e2694cd9c4aab19b377d858f281b54ace68e1a1a2e95de
SHA512

873c80871f3602b7701004075608b059f87140749cab196c0d78ade6a80674d2cc740ddfce85836cae2de5c547996d6b417f0ab68ac05317920b06ff54f01d7d
SSDEEP

49152:h0c24StiTTsdoNDjoJSFWWCycq1mFDbPd3Zm7BmKGMkO/VcmFJRUZYUxPIayLmEa:h36ivJDiSFdph1mPYAlO/hJ6ZYWGqn

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1644	InstGameInfoHelper.exe

Loads dropped DLL 3 IoCs

pid	Process
2276	b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118.exe
2276	b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118.exe
2276	b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstGameInfoHelper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1644	2276	b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118.exe	84
PID 2276 wrote to memory of 1644	2276	b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118.exe	84
PID 2276 wrote to memory of 1644	2276	b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\nsi99B1.tmp\InstGameInfoHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nsi99B1.tmp\InstGameInfoHelper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi99B1.tmp\InstGameInfoHelper.exe

Filesize
99KB

MD5
3d3d2bf9c42dbdf97247775c00f22190

SHA1
7a046170aaeb5e1a29d8c8cd7c32225f49237aa1

SHA256
59f09ba2c79a209008e76d0478bb691a9fdb2180d84318d9fc73b10401aa853a

SHA512
6e66c4ff467e286cd5dc1d4ccd412fec32cfd01514db6c339fd275eaab5f3b549e223e9330bc61ff19048df70b81b66dfcc78ac351aa2c5ff45cf8d197140466

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi99B1.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi99B1.tmp\ftdownload.dat

Filesize
512B

MD5
77bf607e9a08500f477392676ace2269

SHA1
93c42c9884c8b0598e7148b7304d84e8556dd042

SHA256
db484b78472a9fd4c0c1d6161251fb317d8ba0acfb9a76edfbc3057419a1f463

SHA512
464a34e3b34a5312418d65f99f2384d4f2613589712a9c9c4feea17af163d51db00927df2c9a65e49e8fad1fab40486f86f6f9c7db094b67838d6dd6828cf29d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi99B1.tmp\gametitle.txt

Filesize
50B

MD5
5d370cbf46bdfa699b2090dee8b6cb68

SHA1
06c779ccf7d3b75f217b7fe0c176b1248636a574

SHA256
c05b0150d1089952bbea1da8026c01b061f2e2cfd97f45ef4e801f67a53e7728

SHA512
08b2515c579591daeb63cc974a1bd14d0518ad56955ffb878202291c3f4f64a6e2c6915f4fea9c6f6ef209b042e0a045ae4c2a6c7b906a0522aeed37f2b89822

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi99B1.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi99B1.tmp\tn_feat.bmp

Filesize
4KB

MD5
dcd0a26e844e083a5a82d8b23f344c48

SHA1
ec8cc2ed1f94916fb3b7059db82f05a8e83cf4bf

SHA256
6c491e39e7df193b85820523fe870f9198eb89d937ee6700cc202923a1fa6cf2

SHA512
1423460999be8ce01a4c61155276b52487fdc2e1443d8a87aa3202e3d27e5b8e409733b718e05a3607f3fd6427842213de2a5dc742092a359fab07569c1c5043

Download Submit