ca39c00469dd6e4f3c4e93425395503667a369721212717c7a1b92874f9d6efa

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe
Size

476KB
MD5

b2121b10f5be4b01ac8939bfce2a9daa
SHA1

59fa6eddc42410d3333074fc05a2e2d13bfa6d6c
SHA256

ca39c00469dd6e4f3c4e93425395503667a369721212717c7a1b92874f9d6efa
SHA512

030aa3ff4a79652626517cf9fce0fd9fed5bd848cfc23b6c8d80774c372e0ed67f93f66ba99806fa1c26bc71cd1e23eccb61432d7d4447c15f7f38f529488b2e
SSDEEP

3072:KJxXwSmJQMva8zFki2kXbcvpoADLtAjq0wUKCZy9GSkWTdSjpfO0jVGMDm+FyvmJ:pJZv5zFiIONIwRCQ9IWJuh1rem6yJr

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3676 set thread context of 3952	3676	b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 3952	3676	b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe	84
PID 3676 wrote to memory of 3952	3676	b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe	84
PID 3676 wrote to memory of 3952	3676	b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe	84
PID 3676 wrote to memory of 3952	3676	b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe	84
PID 3676 wrote to memory of 3952	3676	b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe	84
PID 3676 wrote to memory of 3952	3676	b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe	84
PID 3676 wrote to memory of 3952	3676	b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe	84
PID 3676 wrote to memory of 3952	3676	b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b2121b10f5be4b01ac8939bfce2a9daa_JaffaCakes118.exe"
  2⤵
  PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3952-2-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3952-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3952-4-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download