47e6522a99d1bc8c709c24c29a792ace4cc5dfb559b5707f1ca828f521c23856

Analysis

max time kernel
144s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
Size

13.4MB
MD5

c25595e2f8b0fca61679d7d1c5543a26
SHA1

be7071633afa01e89b3d38643253195a2fc49f8d
SHA256

47e6522a99d1bc8c709c24c29a792ace4cc5dfb559b5707f1ca828f521c23856
SHA512

09e071af1a9f87c9940fffb8d5bd4a06b6dd943327a4a82c062d331380337b499d66ee62d4ba298da588c1fe42995149a433e8690e3bf0f81246878c2557b402
SSDEEP

192:i2VAKqGxc49My2dNQOm49A476byj9zHJeyJ+43cDimP1oydUV8z5L/CldolMGoVj:iPqcxwAd+43cWQ1jUa1LCcM4aeWFz

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\Googleoa.exe"	Googleoa.exe

Deletes itself 1 IoCs

pid	Process
4004	Googleoa.exe

Executes dropped EXE 2 IoCs

pid	Process
1936	Googleoa.exe
4004	Googleoa.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Debugs.inf	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
File created	C:\Windows\Googleoa.exe	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
File opened for modification	C:\Windows\Googleoa.exe	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
File created	C:\Windows\Debugs.inf	Googleoa.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Googleoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Googleoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 3076	1856	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	84
PID 1856 wrote to memory of 3076	1856	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	84
PID 1856 wrote to memory of 3076	1856	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	84
PID 3076 wrote to memory of 1936	3076	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	87
PID 3076 wrote to memory of 1936	3076	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	87
PID 3076 wrote to memory of 1936	3076	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	87
PID 1936 wrote to memory of 4004	1936	Googleoa.exe	89
PID 1936 wrote to memory of 4004	1936	Googleoa.exe	89
PID 1936 wrote to memory of 4004	1936	Googleoa.exe	89

C:\Users\Admin\AppData\Local\Temp\c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\Googleoa.exe
    "C:\Windows\Googleoa.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\Googleoa.exe
      "C:\Windows\Googleoa.exe"
      4⤵
      Modifies WinLogon for persistence
      Deletes itself
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MyTemp

Filesize
84B

MD5
22df672e8d0b1534210797a96f0e3d57

SHA1
45db74465b0ae3a2ca5238635a6bf6652830810a

SHA256
908ea4508aa77257266215a5fd1c121f5e04fa715b52532f24c52f62be429fa1

SHA512
c8cf789c48a52dcba269a4c9f7f0864b2106440b2989aeaa5b1b9f273109693126d0c1813a9abd9f999f16108cfb26baa5c641d7e6b2d88c742844849f5198de

Download Submit
C:\Windows\Googleoa.exe

Filesize
25.5MB

MD5
4cca96a4f929d23805276eb1b4e1beea

SHA1
3d8bcb9eb8fd223d8e331a387d2748cd797514e7

SHA256
d639440d6c48fbfb682b18cec31879c3cbc1513b5bfc4db0b06a70e31216af9d

SHA512
52df75efe23d1d6ffc096c20f40b24022f07137c3890fc22da3b3928329d169ae0127378b92b75925d2bd044b0d5b7d62bb404c858aa2dc5d087240d8c12e540

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads