6bf8a9551ae84d5b7b33df218682281f4cdf1d46a91718cd8e481daff029d80a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
Size 109KB
Sample240825-nwl3vssepd
SHA256 6bf8a9551ae84d5b7b33df218682281f4cdf1d46a91718cd8e481daff029d80a
MD5 c0ac7bc7d8e913ce6721472a85db8081
SHA1 e5da493cb140e33b06bc7c684348a96f7944b19f
SHA512 c3945910f356d2af281722a5a52992e710c054664f5dfd006a1af8842bd8d6dd46a04b8ff120d83ede986aab3ea9af86c0e6255396c0900d8f03a3d98dd9af37
SSDEEP 3072:Vc1ku8HsnRTfv9Z01N6KVO4OE4vsBfi5X8eXHK:Vc6u5RTfvIPpVlOE4W
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4936	EXPL0RER.EXE
5084	EXPL0RER.EXE

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SysModule32.DLL	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXE	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\MFCD3O.DLL	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File opened for modification	C:\Windows\MFCD3O.DLL	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4936	3152	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	98
PID 3152 wrote to memory of 4936	3152	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	98
PID 3152 wrote to memory of 4936	3152	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	98
PID 3152 wrote to memory of 4220	3152	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	99
PID 3152 wrote to memory of 4220	3152	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	99
PID 3152 wrote to memory of 4220	3152	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	99
PID 4936 wrote to memory of 5084	4936	EXPL0RER.EXE	110
PID 4936 wrote to memory of 5084	4936	EXPL0RER.EXE	110
PID 4936 wrote to memory of 5084	4936	EXPL0RER.EXE	110
PID 4936 wrote to memory of 3628	4936	EXPL0RER.EXE	111
PID 4936 wrote to memory of 3628	4936	EXPL0RER.EXE	111
PID 4936 wrote to memory of 3628	4936	EXPL0RER.EXE	111

C:\Users\Admin\AppData\Local\Temp\c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\EXPL0RER.EXE
  C:\Windows\system32\EXPL0RER.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\SysWOW64\EXPL0RER.EXE
    C:\Windows\system32\EXPL0RER.EXE
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$336699.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$336699.bat

Path C:\Users\Admin\AppData\Local\Temp\$$336699.bat
Size 259B
SHA256 be3316fbcf23501a2d09e9adcd3af1b16cea17eba0fc7464104ed9a59919f748
MD5 95e376be0acf882708d8b53659927870
SHA1 1b4d4157c76b510e6983c49b5bcdb08161c4a1b4
SHA512 f65544f20e25df60a6b79b7c9d34c43f7404570f37baacdedfb9fd15d645739d7ad20f195a3cfc824d9dbcf24d5a577a5c04df56126fe2b6d20dd0d0bc00b04d
MD5 SHA1 SHA512

Submit Download

$$336699.bat

Path C:\Windows\SysWOW64\$$336699.bat
Size 141B
SHA256 a03f261cc17b929ef96c2faeef03b77af3b62ab84bbb73a79beb84878b1bfa61
MD5 e3efc16ca26ae31f9885ee9549ff1f82
SHA1 4321f47a61712ffbbad7a39691359474db4b947c
SHA512 f376e9be088782e394d21958bcdb5e7f00605b05290eff1320d64d5a76bfa619c260c8b5d971e7015bb118f0dd13ad73033f76e55b717611bc1a7d876f8e62ab
MD5 SHA1 SHA512

Submit Download

EXPL0RER.EXE

Path C:\Windows\SysWOW64\EXPL0RER.EXE
Size 109KB
SHA256 6bf8a9551ae84d5b7b33df218682281f4cdf1d46a91718cd8e481daff029d80a
MD5 c0ac7bc7d8e913ce6721472a85db8081
SHA1 e5da493cb140e33b06bc7c684348a96f7944b19f
SHA512 c3945910f356d2af281722a5a52992e710c054664f5dfd006a1af8842bd8d6dd46a04b8ff120d83ede986aab3ea9af86c0e6255396c0900d8f03a3d98dd9af37
SSDEEP 3072:Vc1ku8HsnRTfv9Z01N6KVO4OE4vsBfi5X8eXHK:Vc6u5RTfvIPpVlOE4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysModule32.DLL

Path C:\Windows\SysWOW64\SysModule32.DLL
Size 49KB
SHA256 e9fc263ae7655fd93709ccc31fb25259c6c3de4b50836d7525b75a90ad357a7f
MD5 708e65cea6091b7277e8260d3c4255d4
SHA1 5af3d16dbd7a8dc49672215ec7a94eef7b03a46e
SHA512 8f71f7b633a2efd652e16c85074f406a16d86bc9c9e2dcef10bdcff51a0a4a48337cf7da59b1e622951f14cdb36eae87d3b47d7c28234981c04e757a2e9908a4
SSDEEP 1536:bmFqAF1sa6KczkDVP2DfsOEl4aMsBfXS5X8:b01N6KVO4OE4vsBfi5X8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3152-13-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3152-14-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3152-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3152-30-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3152-11-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3152-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4936-34-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4936-33-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4936-35-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4936-36-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4936-50-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4936-32-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5084-52-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5084-53-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5084-54-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads