461957a7f53a0fac00d26242366aabbb512fbdb9e7f1ad6322efe242e834c4c3

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0a48774d1b0d71dc0c8cad56dcee810_JaffaCakes118.exe
Size

808KB
MD5

d0a48774d1b0d71dc0c8cad56dcee810
SHA1

943e74f8996c93a08180088389de388e27ee35b6
SHA256

461957a7f53a0fac00d26242366aabbb512fbdb9e7f1ad6322efe242e834c4c3
SHA512

c88c70d297d8ec43c01fe82636e181050597eb194c2ed82a1613a6fe156324916fb45b2aff38057f2c7521fe74471261b7bf491a5f5202136113fcd014cf27d7
SSDEEP

24576:upnioetGe52BQX6N+7Ubd+lcOQhxQR9ffKqL1:Uioet95UNNbd6cOQLQRBfK81

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4172	is-JC059.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0a48774d1b0d71dc0c8cad56dcee810_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	is-JC059.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 4172	560	d0a48774d1b0d71dc0c8cad56dcee810_JaffaCakes118.exe	83
PID 560 wrote to memory of 4172	560	d0a48774d1b0d71dc0c8cad56dcee810_JaffaCakes118.exe	83
PID 560 wrote to memory of 4172	560	d0a48774d1b0d71dc0c8cad56dcee810_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\d0a48774d1b0d71dc0c8cad56dcee810_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0a48774d1b0d71dc0c8cad56dcee810_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\AppData\Local\Temp\is-VE61L.tmp\is-JC059.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VE61L.tmp\is-JC059.tmp" /SL4 $90066 "C:\Users\Admin\AppData\Local\Temp\d0a48774d1b0d71dc0c8cad56dcee810_JaffaCakes118.exe" 588334 72704
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-VE61L.tmp\is-JC059.tmp

Filesize
655KB

MD5
650d1c2e915d35da72cd13a659a38179

SHA1
8b479dea03535974d46681086e851dc13ac6d792

SHA256
5aaf3b6e401d32e596204c358195cca7c23f63e57b105a8c92da22150ee750c1

SHA512
d2f0c7778155f1b6eaf974002bbb6b1e26035cb25d2499f86351476ee58705e5301ab8b18c6d9f11fda80f32618d2f1f8b30ba74e4f5c8044d82bb2995ea9762

Download Submit
memory/560-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/560-2-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/560-12-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4172-11-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/4172-13-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download