a50575b36489d8366f7d72df5bae30a17ae7872220e0685ecdb55bdea6a1b2ae

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe
Size

3.6MB
MD5

b3c2ab438cc2efd085914345badac554
SHA1

a24e2a4c4a5ef80dd4df0341998ff099a844edd0
SHA256

a50575b36489d8366f7d72df5bae30a17ae7872220e0685ecdb55bdea6a1b2ae
SHA512

e243812eba8c4ea6003fb416194ad27b014e2058d686fe830e5207fbc6a5c2edf7de029b3e0e4d7b34f3279748c640aff0ea26f9bc70a99f95e49fa0dc527081
SSDEEP

49152:Z0c24StiTTsdoNDjoJSFWWCycq1mFDbPd3Zm7BmKGMkO/VcmFJRUZYUxPIaKLmEG:Z36ivJDiSFdph1mPYAlO/hJ6ZYWWqnd

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2928	InstGameInfoHelper.exe

Loads dropped DLL 3 IoCs

pid	Process
3716	b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe
3716	b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe
3716	b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstGameInfoHelper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2928	3716	b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe	84
PID 3716 wrote to memory of 2928	3716	b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe	84
PID 3716 wrote to memory of 2928	3716	b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b3c2ab438cc2efd085914345badac554_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\nsfC5C2.tmp\InstGameInfoHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nsfC5C2.tmp\InstGameInfoHelper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsfC5C2.tmp\InstGameInfoHelper.exe

Filesize
99KB

MD5
3d3d2bf9c42dbdf97247775c00f22190

SHA1
7a046170aaeb5e1a29d8c8cd7c32225f49237aa1

SHA256
59f09ba2c79a209008e76d0478bb691a9fdb2180d84318d9fc73b10401aa853a

SHA512
6e66c4ff467e286cd5dc1d4ccd412fec32cfd01514db6c339fd275eaab5f3b549e223e9330bc61ff19048df70b81b66dfcc78ac351aa2c5ff45cf8d197140466

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfC5C2.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfC5C2.tmp\ftdownload.dat

Filesize
512B

MD5
438fe103f77b49b6d6d0328ef0428b2d

SHA1
c3f08926eeb5c6ed6f9d8a0bf49961c4b6609de3

SHA256
9ee94683e7dfafe7c9ab925b5525706be3a7012e3b1d3c5b1783ab90dd027875

SHA512
4fc140250c455ba7004e28fb8b5589f9d527af1a17f37e37e8cee0ad12f663b8dd8275b80b66d643a00cc691c957311cf409ef8c6beee4729e5e703d5582b920

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfC5C2.tmp\gametitle.txt

Filesize
48B

MD5
4cdf888fbf69e24dc89854bce68cbbc3

SHA1
900825523ff88817a6c2131d86cb3acc4f1b6e93

SHA256
054aafa031c994727593bd63e842921f2e4271072d17fc465fc538fca48f739b

SHA512
5b76b55c4d5f74aff99de6c08c5d307c8f42f01f66b00c0a4db8980106ed98e7183a148f3e600ccc8c1812f4685da88790b607395cf2971aa9c029c5126731a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfC5C2.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfC5C2.tmp\tn_feat.bmp

Filesize
4KB

MD5
02d95c7a26cd98a28096e93fea5e7391

SHA1
e440cefaaa72e8d729da2b8f8b1ed34bbb24d868

SHA256
38bee18aa19a4ab6eb1996b5d02fe2773680f83d82baf5ea056d81676a112edd

SHA512
bbadb1678f49ee3cb137aaa8d4307b8b429030bf588be2f8acbf2745bd3c5f29985f8c0707214c9329f9776b157992f4a6f7837b292d85b5be8d21c963b65fc6

Download Submit