e82993479e52d4a84978a65a21e0dc56035d8e0242056a10f4a0aadf862d7aea

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe
Size 190KB
Sample240825-nvx4qssemb
SHA256 e82993479e52d4a84978a65a21e0dc56035d8e0242056a10f4a0aadf862d7aea
MD5 c0abf0a38c09efe35673b34df6e7eb9e
SHA1 b191a7852174d376b7b40d86e5ed85b8a039ba15
SHA512 ba94ae31000e7667f9cccd9b5dc397baea852f6d8872f2e759eea5065777aae16b2e94362645841dadfc7f8110607fdf41a36fa922c2ed621490e0f77705fc77
SSDEEP 3072:lErJnhSUPAsJk3x5bn81ovAcB8sVBfWENCX/vYZnsTteoszOQJFrw+rHw:lEFnXP9Jgb8uB/VxNCPwsSzOurtbw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1856-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/4004-12-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/1856-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/2768-87-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/2768-89-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral2/memory/1856-193-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4004	1856	c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe	86
PID 1856 wrote to memory of 4004	1856	c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe	86
PID 1856 wrote to memory of 4004	1856	c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe	86
PID 1856 wrote to memory of 2768	1856	c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe	95
PID 1856 wrote to memory of 2768	1856	c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe	95
PID 1856 wrote to memory of 2768	1856	c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4004
- C:\Users\Admin\AppData\Local\Temp\c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\c0abf0a38c09efe35673b34df6e7eb9e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

031A.ECA

Path C:\Users\Admin\AppData\Roaming\031A.ECA
Size 1KB
SHA256 73da7c5cdeefbd68bd53b516bf3dc450901a9d928fd2522159b6c4c2ecea519a
MD5 d084eff6909afd86af165850f3bd6a40
SHA1 22efab47e34c03e289f3d3fbdc84ec59afe8a657
SHA512 ff52c8c727d42486d8eaf626dafb0afa7de7b458a3b007a4e74256dd473a7bdeaadec1134586198030882a7913d5ef7c92f03b22082617899ef807b683d93a81
MD5 SHA1 SHA512

Submit Download

031A.ECA

Path C:\Users\Admin\AppData\Roaming\031A.ECA
Size 600B
SHA256 24e616850de18cebc7b7b2e7462071df26c1790b2ddf5fc481df493232c0a9ae
MD5 c198d0ad30301507dc1e3ca3782ffb18
SHA1 a76b1c25740d4a77035332d43075ddf3f400f864
SHA512 77e683afc20dd1f7a0f3fb1a1b96f3a82828deed4247f3c6d1b6b6321da8d5492c46e20777e2cd14bd7d38b0b50d97a1743870e8f9691898c5d2861024c1be9b
MD5 SHA1 SHA512

Submit Download

031A.ECA

Path C:\Users\Admin\AppData\Roaming\031A.ECA
Size 996B
SHA256 a9300071c24d057d3b3da220200809e8768b2334b51e86b1e7de62130607aced
MD5 bb594130e9e6d6a6acfe4c009463231a
SHA1 b8ef640e2874136bde0357feacfa5e928cc8a795
SHA512 17d1b69abd68ddeecbb60ac1d54d26a0d7aaad5372a73190eab5cff3167c3b162f1d32ce75756a0a00d96e1211737f1d389cff2b642b98517173865b8c132a8b
MD5 SHA1 SHA512

Submit Download

memory/1856-1-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/1856-2-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/1856-14-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/1856-193-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/2768-86-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/2768-87-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/2768-89-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4004-12-0x0000000000400000-0x000000000044E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads