938d44be10097f59babeea2b2a388e8f71d663c4c543bb2bd599463f0a8b593b

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe
Size

2.0MB
MD5

cfb15f3063108f87d77124e34fe742f6
SHA1

c8cca36ed81d9df4763b49e0fc9ec6ff66f8493c
SHA256

938d44be10097f59babeea2b2a388e8f71d663c4c543bb2bd599463f0a8b593b
SHA512

54d6618093e868a354562fdd50f9273c5de548302d59933c1d974b75345ee23033d1edd21ff827dac06e7a0774e8e0910f985bd1103a2bf630f766edbcc2c23b
SSDEEP

49152:vYYJQBqrxelsRDgq8sNU4tSETKpy6y0OuJTneRLzvNQbVbGbtg:f24clsRDgqPK4cAJlVuBneRLD8Vqbq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1792	QvodInit.exe

Loads dropped DLL 2 IoCs

pid	Process
4644	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe
4644	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QvodInit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 1792	4644	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe	86
PID 4644 wrote to memory of 1792	4644	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe	86
PID 4644 wrote to memory of 1792	4644	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\nsj906B.tmp\QvodInit.exe
  "C:\Users\Admin\AppData\Local\Temp\nsj906B.tmp\QvodInit.exe" WriteIni
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsj906B.tmp\InstallOptions.dll

Filesize
14KB

MD5
0ee1d80ff67f5d5b1aebee2d50e38c9c

SHA1
250aea2e35e51fcd1492b817d1ebe8f467ac2565

SHA256
24215fa79a4e16fc77a103e0257d961e66023f4b89068b04d594463a138bbe1d

SHA512
e745a03b055324a84249abf2914f7cdd8e2e92213c3d51e5ddcc47bb051a525788972532893c0013d03fcc6a90ea8ca2df26d3af7939d08ece1307203de2e88c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj906B.tmp\LangDLL.dll

Filesize
5KB

MD5
29fc9b741c3eb0dc1f5bf9eddf316688

SHA1
f6e7f649d33e5cdbc4c09e331ce132144ed27140

SHA256
65133610bb3db9362b4e37d0dcdf3398eb376c7fba42daef9b73a2f2243cf4be

SHA512
ebb6ad70e18f333a3ed14bf2487647ede5ac565ecc763e7a138bf12068ebf53e6472feaaeeab5c66efbf3acd8d5ef795a4f4982b5eb160b723efe278354793f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj906B.tmp\QvodInit.exe

Filesize
113KB

MD5
68356242edb61a53e3ecd44d96aca83b

SHA1
c518642d0aa312ed2d5d3dd871ae5d8849f03622

SHA256
61f936ef52c7c185dd6539ede1041dbd09b01b53443944a59d69e8dcb4e8f653

SHA512
127ae59caeddb13d16ea91d26ad146634ec6c7c4a0370b0c2b7a86ec8733e1dd4f6d2242a98b6e27b8b35870d1cf1253b56ca50c4ba681fce5be1a7f965494d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj906B.tmp\ioSpecial.ini

Filesize
710B

MD5
860e540598afe664fe90552b8fa65b17

SHA1
108a6b976c131d41c288af49ce4c188fea3351d5

SHA256
cbf82d7ff5efa24a44df628ee016d09846ca5f3cecba04e74a16ee5a69bb422f

SHA512
f285f3e3a792b5be70171f9e0e8c8b467b10a7d48d3596e4abfa03566bab7e91444155bef3ee9ddf63d8c5b1aaf843303d6320e91d6ae6f51c68c3f4a7e72306

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj906B.tmp\qvod1.ini

Filesize
989B

MD5
a9bc1b1575c6962c6ff9b7190fdbe391

SHA1
88d28b25d3c5cbf4255fb2f1f1097f42bebd4370

SHA256
2849326892c2ca46bd097ea530f3de535a05ee9c6649b06aa8b4828a74ca580b

SHA512
7e9c523ed8fc3d9dc744c054ae74064795ccb8c340b10ff44fd82e85d361dd32783f31e055b1db7fac53e4cb085282f2e4b03b5376e96620ba235ee2968bb87d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj906B.tmp\qvod1.ini

Filesize
953B

MD5
4a55e5dd6755c6db43c1f0a279e07d30

SHA1
8d1139165ab9530f061bfa9e5d8b71aee71a3e00

SHA256
856787bdb037af3910c655174eac1d29bbb88a86442857fbbbff5e8ce3164e22

SHA512
4c6a516701853712778c3bb6fa0f14eded15f692c4c8aed4fd4e69d705a71d3f2da066d41377c4e36a296b5592db8d9a6c4ee04063a492ccbd71c15e6ec9923a

Download Submit