8dbb039d4fde97df73cb9abf36b727bfdb309c87187f28dbbf37079afeb94ae0

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
Size

155KB
MD5

d60d36fbe79291d3cfc6f64d49c215b8
SHA1

6712cffa4307ef6e258cffa051009f29a097025f
SHA256

8dbb039d4fde97df73cb9abf36b727bfdb309c87187f28dbbf37079afeb94ae0
SHA512

802792018182a9b7a50b790d3e11d45156ba520deb6aea4b13303961c6645843110c824dfe3af991d372ec5e477c606e863b0c416cc4231e686e24e5c1e977d0
SSDEEP

1536:vWGX5LJVgyn8YBCDJ1LM4SPMu/yuOEejohZ1rlvRfqq1LKIainWSPGEaAv2P8tJd:vWgtC3VsMH81rr/1L7JGEaAvw8PSI

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Systen.dll	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Systen.dll	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\eagbdhjga.dll	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
File created	C:\Windows\284.dat	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
File created	C:\Windows\eagbgjdha.bat	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
File opened for modification	C:\Windows\eagbgjdha.bat	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
Token: SeDebugPrivilege	4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 608	4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	5
PID 4608 wrote to memory of 1620	4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	89
PID 4608 wrote to memory of 1620	4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	89
PID 4608 wrote to memory of 1620	4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	89
PID 4608 wrote to memory of 2452	4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	90
PID 4608 wrote to memory of 2452	4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	90
PID 4608 wrote to memory of 2452	4608	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	90

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608

C:\Users\Admin\AppData\Local\Temp\d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\eagbgjdha.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\eagbgjdha.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\eagbdhjga.dll

Filesize
145KB

MD5
fe2287bede17b4cc972241efa80860f2

SHA1
cec50935c8e76172b67c041786b66098c0340b4d

SHA256
e6b0201308a63a2dd7b96a18afda3df95ea7807adb3c10b4305aedfa2a96c1e1

SHA512
a72bffc72401ca88f09b7ec71d0286a0cfe96eba288e5dbcf38c8a40cf99e2b07c5fc6a1787300e60626bdf2e3fd03c962b4ddb74185c6d33715beaac5f068dd

Download Submit
C:\Windows\eagbgjdha.bat

Filesize
219B

MD5
7dfeab37c9b9d1813e4de601b244750c

SHA1
74c76d0a47fe7d47cc41fbe2c965e1486fdb1e78

SHA256
eff799cf693db0870a7d7682ff9042f4be224975027f7e2e65102dbe2993eeae

SHA512
50cb6f310c29aefa5cbe548da4c173cb7086884910318d940afcbfa4d271ec67f3a02e1b8a42fc4acc5a64c4d059fb24a2298ac94b6f79a11742aff97b0891a7

Download Submit
memory/4608-4-0x0000000000510000-0x0000000000539000-memory.dmp

Filesize
164KB

Download
memory/4608-16-0x0000000000010000-0x000000000003E000-memory.dmp

Filesize
184KB

Download
memory/4608-17-0x0000000000510000-0x0000000000539000-memory.dmp

Filesize
164KB

Download