d50368df7a738abbaa9238dd33cc54ffafcd9b30c00d6fa4c22abd87d0fe44fa

Analysis

max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0075917689273894c19c475b866208a_JaffaCakes118.exe
Size

68KB
MD5

c0075917689273894c19c475b866208a
SHA1

25241f3a5821caeeb988bb9215b614d925acd253
SHA256

d50368df7a738abbaa9238dd33cc54ffafcd9b30c00d6fa4c22abd87d0fe44fa
SHA512

0181e8fd03ae9b4f08cc27b602a44499a73dbbd5436a12f6601471b06b99cda125e62aa59fbc527f0d7133cb6fa8e2573c5771a59dbdc4d0918b469ccc85bf86
SSDEEP

1536:r1BvK2hM46fGBCzSfNNI6yx8Hoh3eypmrYbwWou:r1BvK7pmCzSlNILr7mrlu

Score

7^/10

discovery

Malware Config

Signatures

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3288 set thread context of 2880	3288	c0075917689273894c19c475b866208a_JaffaCakes118.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0075917689273894c19c475b866208a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2880	3288	c0075917689273894c19c475b866208a_JaffaCakes118.exe	84
PID 3288 wrote to memory of 2880	3288	c0075917689273894c19c475b866208a_JaffaCakes118.exe	84
PID 3288 wrote to memory of 2880	3288	c0075917689273894c19c475b866208a_JaffaCakes118.exe	84
PID 3288 wrote to memory of 2880	3288	c0075917689273894c19c475b866208a_JaffaCakes118.exe	84
PID 3288 wrote to memory of 2880	3288	c0075917689273894c19c475b866208a_JaffaCakes118.exe	84
PID 3288 wrote to memory of 2880	3288	c0075917689273894c19c475b866208a_JaffaCakes118.exe	84
PID 3288 wrote to memory of 2880	3288	c0075917689273894c19c475b866208a_JaffaCakes118.exe	84
PID 3288 wrote to memory of 2880	3288	c0075917689273894c19c475b866208a_JaffaCakes118.exe	84
PID 3288 wrote to memory of 2880	3288	c0075917689273894c19c475b866208a_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\c0075917689273894c19c475b866208a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c0075917689273894c19c475b866208a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Users\Admin\AppData\Local\Temp\c0075917689273894c19c475b866208a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c0075917689273894c19c475b866208a_JaffaCakes118.exe"
  2⤵
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2880-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2880-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download