4661e6f2cc4e5abb1ebb091b73433af1a20b6eb72e99ab4fdf6b0c4c10beeb41

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.exe
Size

30.2MB
MD5

d498f0ebcbff7f2728a28437a3f4b0f3
SHA1

1b976a0f5870a0aefbec0665ba70bfef4cdae3f5
SHA256

4661e6f2cc4e5abb1ebb091b73433af1a20b6eb72e99ab4fdf6b0c4c10beeb41
SHA512

bd14a7170880a0ccfefa4f3535b477a3d24fa285d9641c416b2dc54a716420face18f5a56258f3c9aa13bfdbc9b39606b03193a16702b9adf966325a8c9b03bf
SSDEEP

786432:9j4HDgZSVPG/r7aDF2kLWB8a+TThBvYLjtISK1aC:KVGz7afWBOT7YXkkC

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4244	d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4244	1504	d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.exe	85
PID 1504 wrote to memory of 4244	1504	d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.exe	85
PID 1504 wrote to memory of 4244	1504	d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\is-LEIVT.tmp\d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LEIVT.tmp\d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.tmp" /SL5="$60282,31382366,56832,C:\Users\Admin\AppData\Local\Temp\d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-LEIVT.tmp\d498f0ebcbff7f2728a28437a3f4b0f3_JaffaCakes118.tmp

Filesize
697KB

MD5
13570ffb9a7675596b729d2d7e687f50

SHA1
115827ad41742c3e9c8abf78d3ce9b0878cd3f42

SHA256
1f1271263c583b841854fe9e1a393f6e048441953e3ea6caad789ff6ddb6ed33

SHA512
22d2dd29a2829c1fcb4e703611d0b5cfaf1f1bff1d90e08c55808e71eda008c2a8b40571c5853d08b86f698d81348a77621e048686b7e5556264a800fe1e98a0

Download Submit
memory/1504-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1504-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1504-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4244-7-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4244-14-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download