a9ef2de92cc19be7b4975bb709d483d9f881ee576e5125848c9f9dd79dd4c138

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe
Size

148KB
MD5

e276b8d46f354aff1a1c1dd6ecd486dd
SHA1

719d4eb33bcd289c499d83b2109a5d8e5fa60642
SHA256

a9ef2de92cc19be7b4975bb709d483d9f881ee576e5125848c9f9dd79dd4c138
SHA512

b3c0beb367b5b624c3ecb410ae99d48c548e863dc5d5a789e507ae21e0c4313a0cdae3c3baa71d7e13955daf3deff10e37d38caf81b157907585d98e4761e3a2
SSDEEP

3072:QhZ5lsJWBXssRGciYyT9fgmw7DI7XObJoB/lr9i:QhZGWBX6

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
904	svchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dxdiag.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dxdiag.exe	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3088 set thread context of 1988	3088	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1988	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3088	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 1988	3088	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe	86
PID 3088 wrote to memory of 1988	3088	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe	86
PID 3088 wrote to memory of 1988	3088	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe	86
PID 3088 wrote to memory of 1988	3088	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe	86
PID 3088 wrote to memory of 1988	3088	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe	86
PID 3088 wrote to memory of 1988	3088	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe	86
PID 1988 wrote to memory of 904	1988	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe	87
PID 1988 wrote to memory of 904	1988	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe	87
PID 1988 wrote to memory of 904	1988	e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Users\Admin\AppData\Local\Temp\e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e276b8d46f354aff1a1c1dd6ecd486dd_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Deletes itself
    - Drops startup file
    - System Location Discovery: System Language Discovery
    PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dxdiag.exe

Filesize
148KB

MD5
e276b8d46f354aff1a1c1dd6ecd486dd

SHA1
719d4eb33bcd289c499d83b2109a5d8e5fa60642

SHA256
a9ef2de92cc19be7b4975bb709d483d9f881ee576e5125848c9f9dd79dd4c138

SHA512
b3c0beb367b5b624c3ecb410ae99d48c548e863dc5d5a789e507ae21e0c4313a0cdae3c3baa71d7e13955daf3deff10e37d38caf81b157907585d98e4761e3a2

Download Submit
memory/904-7-0x0000000000320000-0x0000000000322000-memory.dmp

Filesize
8KB

Download
memory/904-11-0x0000000000320000-0x0000000000322000-memory.dmp

Filesize
8KB

Download
memory/904-32-0x0000000000320000-0x0000000000322000-memory.dmp

Filesize
8KB

Download
memory/1988-2-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1988-3-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1988-6-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download