4f1451a1cd63567ceca49118d5b0e9bbb11a28d16aa5b373d42fe861b924a776

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d563e6efd89a55e47abe3ebe2cb5dc68_JaffaCakes118.exe
Size

49KB
MD5

d563e6efd89a55e47abe3ebe2cb5dc68
SHA1

9fa8b8452882692d3498c8727369c422434f687e
SHA256

4f1451a1cd63567ceca49118d5b0e9bbb11a28d16aa5b373d42fe861b924a776
SHA512

3a2896d3271d3c33762d468922e4dd277059d2a1dcf95f930324e3d74a183d0b6e546280b245e9430491025ea4faf2e9a2d2d240787d2e12dc8f32459ab827c4
SSDEEP

768:9FOvFOTl3IFOs8a1exNvilQghg3upkl160dTdcEnLKjQG111yfsP7:msh7smTvS3+6gnmMQcfsP7

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1792	WinRoot32.e

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WinRoot32.e	d563e6efd89a55e47abe3ebe2cb5dc68_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d563e6efd89a55e47abe3ebe2cb5dc68_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRoot32.e

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1792	WinRoot32.e
1792	WinRoot32.e
1792	WinRoot32.e
1792	WinRoot32.e

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3680	d563e6efd89a55e47abe3ebe2cb5dc68_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 1792	3680	d563e6efd89a55e47abe3ebe2cb5dc68_JaffaCakes118.exe	83
PID 3680 wrote to memory of 1792	3680	d563e6efd89a55e47abe3ebe2cb5dc68_JaffaCakes118.exe	83
PID 3680 wrote to memory of 1792	3680	d563e6efd89a55e47abe3ebe2cb5dc68_JaffaCakes118.exe	83
PID 1792 wrote to memory of 3584	1792	WinRoot32.e	56
PID 1792 wrote to memory of 3584	1792	WinRoot32.e	56
PID 1792 wrote to memory of 3584	1792	WinRoot32.e	56
PID 1792 wrote to memory of 3584	1792	WinRoot32.e	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3584
- C:\Users\Admin\AppData\Local\Temp\d563e6efd89a55e47abe3ebe2cb5dc68_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d563e6efd89a55e47abe3ebe2cb5dc68_JaffaCakes118.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\WinRoot32.e
    C:\Windows\system32\WinRoot32.e
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WinRoot32.e

Filesize
29KB

MD5
30fa0863a0884df88f2ddaadfe2dda56

SHA1
233686f4f651ad0e1d2160c3e0a8986e6f3d2002

SHA256
fa3761d1c70b38e1bdc2d1cae2445536f7d04acfd3645fcbe1d2c322dc1a9547

SHA512
08bc09366533187c95ad5560457069ef7fba485082eae98687ed0806c71a542b269d1e1aac69840507003c216424574111336672ab3aac3a68797e2bd603bdbb

Download Submit
memory/1792-7-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1792-9-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1792-14-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1792-15-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/3584-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3584-11-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download