b01f834ee2ddc5323cf9af1a1fc5604e6987ec856ce362465ad40499d1f65fc6

Analysis

max time kernel
141s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dc190648617de692d6a34f3fa069daae_JaffaCakes118.exe
Size

301KB
MD5

dc190648617de692d6a34f3fa069daae
SHA1

c1f99e2d3935a8f298016a453f91e79cf6baec97
SHA256

b01f834ee2ddc5323cf9af1a1fc5604e6987ec856ce362465ad40499d1f65fc6
SHA512

cbf95455ca9ef5d165315417393c50b40d1f54d6e4e88eab02e46936f47211e1df2ff66fc942e767cb833ea247decedb560c148ece29c32179f9848cb6b1d04c
SSDEEP

6144:XSYbXXKOiPs03UM9RZJUr+aDfod2Wm2gaTvYEmu8QAWHoS:iUXabPD3DZyrOd2qHTXKQAWHoS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4060	RemoteAbc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\R_Server\RemoteAbc.exe	dc190648617de692d6a34f3fa069daae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\R_Server\RemoteAbc.exe	dc190648617de692d6a34f3fa069daae_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RemoteAbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc190648617de692d6a34f3fa069daae_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4060	RemoteAbc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2420	904	dc190648617de692d6a34f3fa069daae_JaffaCakes118.exe	90
PID 904 wrote to memory of 2420	904	dc190648617de692d6a34f3fa069daae_JaffaCakes118.exe	90
PID 904 wrote to memory of 2420	904	dc190648617de692d6a34f3fa069daae_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\dc190648617de692d6a34f3fa069daae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc190648617de692d6a34f3fa069daae_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\VPPMWS.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2420

C:\Program Files (x86)\R_Server\RemoteAbc.exe
"C:\Program Files (x86)\R_Server\RemoteAbc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\R_Server\RemoteAbc.exe

Filesize
301KB

MD5
dc190648617de692d6a34f3fa069daae

SHA1
c1f99e2d3935a8f298016a453f91e79cf6baec97

SHA256
b01f834ee2ddc5323cf9af1a1fc5604e6987ec856ce362465ad40499d1f65fc6

SHA512
cbf95455ca9ef5d165315417393c50b40d1f54d6e4e88eab02e46936f47211e1df2ff66fc942e767cb833ea247decedb560c148ece29c32179f9848cb6b1d04c

Download Submit
C:\Users\Admin\AppData\Local\Temp\VPPMWS.bat

Filesize
218B

MD5
1004129c184bd1899545a8f84af125d6

SHA1
e30872e59716469bb1650ca1e151bc29cea91fc2

SHA256
d27c7db76a5dd0ead559b8791d21b5756a96228da19cec9d598e34b001765510

SHA512
bbfa4d60c54824346bcad4a722f650b2b5c05622792fbfec641a508c5e6631651139145b3c2f60824fbbe425b6d1d26d7cde10065205603340f24962fcb9b00a

Download Submit
memory/904-0-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download
memory/904-1-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/904-11-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download
memory/4060-6-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download
memory/4060-7-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/4060-13-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download
memory/4060-15-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/4060-18-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download
memory/4060-22-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download
memory/4060-26-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download