c3aceb7a1caa01498e1badf074aa660f22059d0602ac8b24124677f1fd79e96e

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 16:05

Target

bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe
Size

128KB
MD5

bc6baf26f4c42065beccbb05ec3fe1d0
SHA1

6990d9d00e07da251999f0b8d53c73f956bf5612
SHA256

c3aceb7a1caa01498e1badf074aa660f22059d0602ac8b24124677f1fd79e96e
SHA512

fbe539166cc978bcef069b02fdf9b684eb9946d1ed97b4c64f01a3e53f012a0d046110c9b5095ef2d779ea8b2a2950191546d028cf4934b4bfbd8d86df77a117
SSDEEP

3072:t5tleuABawY8nNQE87bQ17Jh/nbUegJVImEV98:tLlefEQ17Jh/bU1JumEc

Score

6^/10

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\\Remlive.exe"	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Accessories\Common\desktop.ini	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Accessories\Common\desktop.ini	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Accessories\Common\desktop.ini	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Accessories\Common	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Accessories\Common\desktop.ini	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hpvert.dll	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4908	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1800	4908	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe	87
PID 4908 wrote to memory of 1800	4908	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe	87
PID 4908 wrote to memory of 1800	4908	bc6baf26f4c42065beccbb05ec3fe1d0_JaffaCakes118.exe	87
PID 1800 wrote to memory of 2072	1800	cmd.exe	89
PID 1800 wrote to memory of 2072	1800	cmd.exe	89
PID 1800 wrote to memory of 2072	1800	cmd.exe	89
PID 1800 wrote to memory of 2104	1800	cmd.exe	90
PID 1800 wrote to memory of 2104	1800	cmd.exe	90
PID 1800 wrote to memory of 2104	1800	cmd.exe	90