92600d35bf740272d948d67cf595ac7fdc1da5fcd4b80cc39f64871c57fb2488

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe
Size

812KB
MD5

c1a5c08e27d93713802cb00235447a17
SHA1

fd070786781da66f67b8eece92eecbfbcd04fcf3
SHA256

92600d35bf740272d948d67cf595ac7fdc1da5fcd4b80cc39f64871c57fb2488
SHA512

35555685d0290dd10d4881443f6216314465a20798761e644cb66e5cffb69dbb91030ebc54093ab8aeb10e96a8ea12381734c5f4825ebc37cc82e38a538e9c0d
SSDEEP

12288:6QoutGe7ZVVT7ZD3wUdm7dv88vUcYgTJwri42gmm4QB3wCbt+qQ1wqK3Xd8:6FutG2VT9T7m5v88vUWGrgmOCbtREY

Score

7^/10

discovery evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4440	ntapli.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	ntapli.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ntapli.exe	c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ntaplidrv.sys	c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ntaplisdrv.sys	c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntapli.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4760	c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe
4760	c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4440	4760	c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe	90
PID 4760 wrote to memory of 4440	4760	c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe	90
PID 4760 wrote to memory of 4440	4760	c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c1a5c08e27d93713802cb00235447a17_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\ntapli.exe
  C:\Windows\system32\ntapli.exe
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - System Location Discovery: System Language Discovery
  PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ntapli.exe

Filesize
764KB

MD5
0cab912734c24625aed9a0b1c04a126f

SHA1
271f4872c6ca96383b2fefc3d5682ddb178aacb1

SHA256
08463cba39af53896bb059a864bcab32b3389b50943e1503809b15d2b8e7d8e1

SHA512
eea24743e60aea3758e9ea77076cb18c39e87db4f8cf5e0359979e68878a4518754efff58214b794ed4015b460e16f305e33dbe0bc77b256ceddcc4dfffac327

Download Submit
memory/4440-5-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/4440-7-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads