e98de1c42fcf02063b5efeb11510318e1f76ae34cd51afa5eaa166d113844aaa

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfc1c57af62b79410532542d994b32b3_JaffaCakes118.exe
Size

17.5MB
MD5

cfc1c57af62b79410532542d994b32b3
SHA1

a9ba5f796a9d89bb735dc3e5cb82b1a528c7db8b
SHA256

e98de1c42fcf02063b5efeb11510318e1f76ae34cd51afa5eaa166d113844aaa
SHA512

93dcf6a79eb62529efedf5fde84c2a9dd03a4f8448dd07b944b0df0e324a897489ecd5e11605cae24e109395368dde423bfcb7121f5367f4251f2407badbe7ad
SSDEEP

393216:9h2fx/clQCaLFkvLHZrYnH7lIZPqWIvCC5QdQy2uIjXYn4rKogx:Yx/yQP0LHJUlIZqWIKCmBlqXY4rE

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
5036	cfc1c57af62b79410532542d994b32b3_JaffaCakes118.tmp

Loads dropped DLL 2 IoCs

pid	Process
5036	cfc1c57af62b79410532542d994b32b3_JaffaCakes118.tmp
5036	cfc1c57af62b79410532542d994b32b3_JaffaCakes118.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfc1c57af62b79410532542d994b32b3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfc1c57af62b79410532542d994b32b3_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 5036	1036	cfc1c57af62b79410532542d994b32b3_JaffaCakes118.exe	85
PID 1036 wrote to memory of 5036	1036	cfc1c57af62b79410532542d994b32b3_JaffaCakes118.exe	85
PID 1036 wrote to memory of 5036	1036	cfc1c57af62b79410532542d994b32b3_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\cfc1c57af62b79410532542d994b32b3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cfc1c57af62b79410532542d994b32b3_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\is-V3DS9.tmp\cfc1c57af62b79410532542d994b32b3_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-V3DS9.tmp\cfc1c57af62b79410532542d994b32b3_JaffaCakes118.tmp" /SL5="$601EE,17842948,119808,C:\Users\Admin\AppData\Local\Temp\cfc1c57af62b79410532542d994b32b3_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-4DQGH.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V3DS9.tmp\cfc1c57af62b79410532542d994b32b3_JaffaCakes118.tmp

Filesize
1.1MB

MD5
8cff4623ba6b804ae79e3b9a0e418191

SHA1
081c5718d2bd064209d423d4dc72f2e2abb53138

SHA256
3bc47878ad889969abb1783f79d9ff8fed3f4f2139c34f485183a34d14e71792

SHA512
83bee762bac56eca7b122321c9cbddaaf1cfdd6f14eda788ce62a6fb7b9665fb681b0e3569739ec9b17464beadcd39b9db26f905074d57b6ab328a53d5ce25e0

Download Submit
memory/1036-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1036-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/1036-15-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/5036-6-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/5036-12-0x0000000003320000-0x000000000335C000-memory.dmp

Filesize
240KB

Download
memory/5036-16-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/5036-17-0x0000000003320000-0x000000000335C000-memory.dmp

Filesize
240KB

Download
memory/5036-21-0x0000000003320000-0x000000000335C000-memory.dmp

Filesize
240KB

Download
memory/5036-20-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download