8a325fcaa289beb598ccb641262b40a9bbac8ad216ba1c322acaa31d6f8c0dfc

Analysis

max time kernel
148s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe
Size

139KB
MD5

bc2dd2f9a1b0a9dbf0d4a427e6bce5d0
SHA1

8ec3e8a4e4ebbd1be93afd99308ec6e14831b597
SHA256

8a325fcaa289beb598ccb641262b40a9bbac8ad216ba1c322acaa31d6f8c0dfc
SHA512

feb1637cf74a1c77748383038b77a1a35410b743b1bfb0de35fd082ef09b43807360034c9233324e8a4c81ff8755c2eb4a4eb02ff2c9b8f0261d1d9c001d19f6
SSDEEP

3072:Bz40LFGWEBMWeWiYVo6kAkxSlNEtqfBH8c0cOLbPKB2:Bz4yFtEBMWviYO6Fk4LBHbSbPKB2

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1648 set thread context of 4140	1648	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1648	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 4140	1648	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe	86
PID 1648 wrote to memory of 4140	1648	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe	86
PID 1648 wrote to memory of 4140	1648	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe	86
PID 1648 wrote to memory of 4140	1648	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe	86
PID 1648 wrote to memory of 4140	1648	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe	86
PID 1648 wrote to memory of 4140	1648	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe	86
PID 1648 wrote to memory of 4140	1648	bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\bc2dd2f9a1b0a9dbf0d4a427e6bce5d0_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1648-1-0x0000000000401000-0x0000000000489000-memory.dmp

Filesize
544KB

Download
memory/1648-9-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4140-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4140-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4140-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4140-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4140-11-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download