11e2c6dad86e88e96a437e9c3097e57535a0ad610d07e92c2e30208b1faa62ce

Analysis

max time kernel
140s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.exe
Size

2.2MB
MD5

db822bc8dee48bd47b85b7656a86f1c7
SHA1

5789468de5dd42df19a8781aeb45d6f34d58c0b2
SHA256

11e2c6dad86e88e96a437e9c3097e57535a0ad610d07e92c2e30208b1faa62ce
SHA512

cd90cc35f5480b4fbcf64f001dc604a0a8c6b8a9e3d3c24e5fd5fe6d2137e0d7ca2ec5364a786eced6a1f4b44fa441d330c1b74083d8949fa8429c6cbccf914f
SSDEEP

24576:MTfEsP85DgJrivY05+Qa7IaVXExYksPNbbXekEKeEvrmV5mjkO7IlWfZeik+wsul:2csQ6QraVEgldm8gUgs9udI3WA2n5fj

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2492	db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2492	4948	db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.exe	85
PID 4948 wrote to memory of 2492	4948	db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.exe	85
PID 4948 wrote to memory of 2492	4948	db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\is-ER4GB.tmp\db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ER4GB.tmp\db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.tmp" /SL5="$5020A,1549299,721408,C:\Users\Admin\AppData\Local\Temp\db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-ER4GB.tmp\db822bc8dee48bd47b85b7656a86f1c7_JaffaCakes118.tmp

Filesize
2.4MB

MD5
84db4b4205f705da71471dc6ecc061f5

SHA1
b90bac8c13a1553d58feef95a2c41c64118b29cf

SHA256
647983ebde53e0501ff1af8ef6190dfeea5ccc64caf7dce808f1e3d98fb66a3c

SHA512
c5803b63d33bb409433b496b83ca2a7359b4b1835815386206283b3af5c54d7d1cb9e80244a888638c7703c4bf54e1b2c11be6836f20b9fea157ab92bfbf365a

Download Submit
memory/2492-6-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2492-10-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/4948-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/4948-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4948-8-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download