c6c4a148fd11dfba881b1e04509b229af378c4bc15c7c4ef8435fb7d23fa8966

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe
Size

1.5MB
MD5

b36a25a7f0b92dfba3a2d6320938c6b8
SHA1

09698030231078824f10e40e475e7d8d9abc4b63
SHA256

c6c4a148fd11dfba881b1e04509b229af378c4bc15c7c4ef8435fb7d23fa8966
SHA512

d076cbf50b8981b8e1155c7de6bab5dc3c780ca0c8514609ed4865d1774df4bcc10cf7374ac5a1fadba6b4db11d22ced0068df83168de73b4c9bb8b582f3f613
SSDEEP

24576:cQbz+mcdH5sY0DOMLiMXSspgE1vIXLYGXmRhzPchYUhER58q06jysYGKY9bCs6vB:J4dH58LLSspgE1v0LpQzPNdD06ofWCeA

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1432	WRAR38~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4088 set thread context of 4532	4088	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WRAR38~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1432	WRAR38~1.EXE
1432	WRAR38~1.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4532	4088	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe	84
PID 4088 wrote to memory of 4532	4088	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe	84
PID 4088 wrote to memory of 4532	4088	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe	84
PID 4088 wrote to memory of 4532	4088	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe	84
PID 4088 wrote to memory of 4532	4088	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe	84
PID 4532 wrote to memory of 1432	4532	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe	85
PID 4532 wrote to memory of 1432	4532	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe	85
PID 4532 wrote to memory of 1432	4532	b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Local\Temp\b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b36a25a7f0b92dfba3a2d6320938c6b8_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WRAR38~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WRAR38~1.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WRAR38~1.EXE

Filesize
1.2MB

MD5
9ac5a4d6dc9b18c9b580f7c8b0bac5f5

SHA1
fe2b35cf87fcadbff5576d817c3741fb4f4a492d

SHA256
f2d7c6dabd00eac6ea8f7b82df217faefdeb690f6b8bd6488c89433e1dddbebd

SHA512
84b409237f7e0109e4b7f0050e832dda4ed95fdf9178db1fde46f1eaf3a8861236c29b2fbabb688e4bd4f40a604555dab5b690adba484c3b576bd2e656bcf335

Download Submit
memory/1432-12-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4532-0-0x0000000001000000-0x000000000117B000-memory.dmp

Filesize
1.5MB

Download
memory/4532-2-0x0000000001000000-0x000000000117B000-memory.dmp

Filesize
1.5MB

Download
memory/4532-1-0x0000000001000000-0x000000000117B000-memory.dmp

Filesize
1.5MB

Download
memory/4532-5-0x0000000001000000-0x000000000117B000-memory.dmp

Filesize
1.5MB

Download
memory/4532-11-0x0000000001000000-0x000000000117B000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads