9372af030b91a1451f80130fa8ce7703ddf6d3ed4824c3c0a77c180915927157

Analysis

max time kernel
106s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
Size

680KB
MD5

da55064051a441508ef898dbdf6788c4
SHA1

ce2fe0521f01c2d30bf4795d0a2513fcf0123260
SHA256

9372af030b91a1451f80130fa8ce7703ddf6d3ed4824c3c0a77c180915927157
SHA512

cdfd3215c078482526a401fce1a1531511c4ebf329b799a9010c16ba7915f499374239c54a5178ee86bd0083b8ad09fbd4b2850d96a43aa4d5b0091471a1840a
SSDEEP

12288:vgGpG+Cxq/5j0fqW+q/1sscnQjeaRXebHEvSp9FbVCW1MaO52EhyjNkLHa:ozK4kd3QaFkvSp9FIWerxLa

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4088 set thread context of 1084	4088	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
1084	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1084	4088	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe	84
PID 4088 wrote to memory of 1084	4088	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe	84
PID 4088 wrote to memory of 1084	4088	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe	84
PID 4088 wrote to memory of 1084	4088	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe	84
PID 4088 wrote to memory of 1084	4088	da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Local\Temp\da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\da55064051a441508ef898dbdf6788c4_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ptsCC1A.tmp

Filesize
88KB

MD5
b887a3462b71117cec99b12a57301ee4

SHA1
f5e25aef2fdef6ee8f00e3963a80fd7c5a53face

SHA256
c9b91157adaa394e9e01ed0b77fc02c67ca2a48aa347b0a2ac12cd8fea7c40c2

SHA512
8f0d92519fe50accb5dab5884d5c797f7ed48335becbc36f99e2749ccec2557aeb34df93310f24b6d0e53938bf7bd9e8dba2f9596de4f6667db59f96076d97a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ptsCC2A.tmp

Filesize
88KB

MD5
b793cad3af548c60e7df0169d25e6bed

SHA1
e88c5c3ebc49200388031812b4908fb1c4c31cfb

SHA256
52ac22fbbbe418a310540e826a80fc86ef98ac7823c1b41ef8f9a6482845ec3c

SHA512
2b3693d7390353746f1986bb5555620a1fea3f7314d1d332e2fa4ee717da8631806223bab59578831b1a0e8661865a48540674a1f88a098865b4db1d765dc7b3

Download Submit
memory/1084-14-0x0000000000750000-0x0000000000768000-memory.dmp

Filesize
96KB

Download
memory/1084-3-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-5-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-6-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-2-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-4-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-0-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-16-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-17-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-29-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-42-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-44-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/1084-49-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download