5c31f5dc679c77de113423b13b1b9b9f61c8d8b9d372a89880c9bbf0afe984b3

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
Size

251KB
MD5

b5b9c175ac82703e40fc4b7f8df095e0
SHA1

12f658b17e3f2cce74ae6b2bfa21cec87ae78320
SHA256

5c31f5dc679c77de113423b13b1b9b9f61c8d8b9d372a89880c9bbf0afe984b3
SHA512

b60d672b5aba4ee88afe291f8e034e3fd5b73b55c460b7af397f5c585ce595c5a4835670c9710214abe4650b8697c7f9c22213454b3b007d0051bbda19f4060d
SSDEEP

6144:ksa52MXYwmTzXBnVW5GJZ2tNYLj8Mfs4ZkvlM:na52MoLfXBVzYKj86sgk9M

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 4160	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe	84
PID 4648 set thread context of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 set thread context of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 set thread context of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 set thread context of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 set thread context of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4160	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe	84
PID 4648 wrote to memory of 4160	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe	84
PID 4648 wrote to memory of 4160	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe	84
PID 4648 wrote to memory of 4160	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe	84
PID 4648 wrote to memory of 4160	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe	84
PID 4648 wrote to memory of 4160	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe	84
PID 4648 wrote to memory of 4160	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe	84
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
PID 4648 wrote to memory of 0	4648	b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b5b9c175ac82703e40fc4b7f8df095e0_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4160-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4160-30-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4160-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4648-12-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-10-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-6-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4648-5-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4648-19-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/4648-18-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/4648-17-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-16-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-15-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-14-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-13-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-0-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4648-11-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-7-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-9-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-8-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-3-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4648-20-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4648-21-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4648-22-0x0000000000401000-0x0000000000425000-memory.dmp

Filesize
144KB

Download
memory/4648-4-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4648-1-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-2-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-28-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4648-32-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download