ac142eb9d3337c3d4ca3746f250af5dcf6f37797df88b5ed1881997b8c977228

Resubmissions

24/08/2024, 12:54

240824-p5geeasfqp 10

24/08/2024, 12:44

240824-pypgfasdjq 10

Analysis

max time kernel
1s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24/08/2024, 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be9ded0056137d49dc52410398abaef4_JaffaCakes118.exe
Size

2.2MB
MD5

be9ded0056137d49dc52410398abaef4
SHA1

c24a719f6aae7289bcd708e7e7f00e6e5772b3b3
SHA256

ac142eb9d3337c3d4ca3746f250af5dcf6f37797df88b5ed1881997b8c977228
SHA512

4081e7536af06afcac5c715883a9afc463d8c175167d1f4afd96c58992a75188ac2d23d2cdc4d8fae6105cd485086f60b645d0e20e9b75a2b03bef997230a6a8
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZv:0UzeyQMS4DqodCnoe+iitjWwwT

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	be9ded0056137d49dc52410398abaef4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be9ded0056137d49dc52410398abaef4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1708	2136	be9ded0056137d49dc52410398abaef4_JaffaCakes118.exe	81
PID 2136 wrote to memory of 1708	2136	be9ded0056137d49dc52410398abaef4_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\be9ded0056137d49dc52410398abaef4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\be9ded0056137d49dc52410398abaef4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
memory/2136-0-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download