f64696c9603ea752b69a2bef52d179690839b2f5e42036b907ff77f17d2e7b2b

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.exe
Size

1.5MB
MD5

c874636f2a695ef85c326bf453ab87e1
SHA1

ec8898deef21095130949d6e4331a037d627f67e
SHA256

f64696c9603ea752b69a2bef52d179690839b2f5e42036b907ff77f17d2e7b2b
SHA512

5bc1a88300db851c95fd1ea3830feafca313579fa3cf79affdce79c004212043373c6e69946048a8f859d857a441853d21a5219cc65dfebfc51570b1e17d549a
SSDEEP

24576:FBWRYofFk6G+GV/sZQpfOAUDkQUIxDLf4ltCOqCMCdM9x7VNrxaDKUw9Yj26Is:udkt+E/pUgEx3SvzMPjrwA/S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1744	c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.tmp

Loads dropped DLL 3 IoCs

pid	Process
1744	c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.tmp
1744	c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.tmp
1744	c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 1744	4200	c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.exe	84
PID 4200 wrote to memory of 1744	4200	c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.exe	84
PID 4200 wrote to memory of 1744	4200	c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\is-4QPS0.tmp\c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4QPS0.tmp\c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.tmp" /SL5="$80210,1141700,488960,C:\Users\Admin\AppData\Local\Temp\c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-4QPS0.tmp\c874636f2a695ef85c326bf453ab87e1_JaffaCakes118.tmp

Filesize
1.5MB

MD5
39ce288ba1bc6c271007814c843e7409

SHA1
686c00e2acd32b5b5f3d2416415962df9b2f9e1b

SHA256
5853ecc27de9ba3db5eef3c423f567705cf4bd174bf69146a183dc303bdaf805

SHA512
b105df21621b6b2a899d23c222d2bb9df5bcdd85bac2b520de1ffabb7e5e92ca414f2ddfa61152653689c875c60d3087647c900f6133896bab585bbde702436b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C3RT0.tmp\AppsetOfferImage.png

Filesize
47KB

MD5
eb381c517f711d1a485b8f2488de479b

SHA1
e6fa37670712511f0a9c08f5f20fc7bc259f7f23

SHA256
c0ebbf9b8a7bc9847fc3a538277f49446e30e899308c1799c502a4547c2266fa

SHA512
9645501241cfe0d7340e03d6d5fcb6ddee2f8e2d873801c4bbdbb843cf1d332a8d413a4cfa6548f1707a2604acc19d1843dc1e698ec5ef1711a96d3d55015353

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C3RT0.tmp\NativeUID.dll

Filesize
86KB

MD5
d47e7649fc7b9bd91c7d091fde71b889

SHA1
19f11f2135982df97b9fda8fa5c9ce7813c99b1e

SHA256
a2583dbfd24d9061954dc185d1d5e43cff71ccc1342c6e87d7c349b70e8fa9ab

SHA512
262510f7ced40dc69e804a2b675b71a2ca25e9195428a55537c6dc3a7845bdcc8a8273e83a439bac05bc15bb4d194810cdda2b08678a6a9cd8a0b5eb628f1017

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C3RT0.tmp\Ya_distr_342x422.png

Filesize
12KB

MD5
b273649b75d640ccd6921e22f7016566

SHA1
bada8845019c51035c4728d221505524014dfdf1

SHA256
632bce31329fb202b24a76ca7cc15264bd88562de9b41783d9cb61154c6d78bb

SHA512
529b824dfe32e4ebae4be35812a96a05f6869c5f928d121dd1b78573d893aa04320cc8d6d3a3026509456de8c33ff98d891117e96323ed08e3797472ba18f726

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C3RT0.tmp\botva2.dll

Filesize
41KB

MD5
ef899fa243c07b7b82b3a45f6ec36771

SHA1
4a86313cc8766dcad1c2b00c2b8f9bbe0cf8bbbe

SHA256
da7d0368712ee419952eb2640a65a7f24e39fb7872442ed4d2ee847ec4cfde77

SHA512
3f98b5ad9adfad2111ebd1d8cbab9ae423d624d1668cc64c0bfcdbfedf30c1ce3ea6bc6bcf70f7dd1b01172a4349e7c84fb75d395ee5af73866574c1d734c6e8

Download Submit
memory/1744-6-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1744-18-0x00000000039E0000-0x00000000039EF000-memory.dmp

Filesize
60KB

Download
memory/1744-37-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1744-36-0x00000000039E0000-0x00000000039EF000-memory.dmp

Filesize
60KB

Download
memory/4200-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/4200-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4200-34-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download