595a57e5444395da080d4eba13099e471bad7a1eaba0d2506b581353402b90ba

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7b9649882cc177e14b7dd0d368a7bb_JaffaCakes118.exe
Size

232KB
MD5

ea7b9649882cc177e14b7dd0d368a7bb
SHA1

e718416e6402e9a997828166fb2b4415b2c32bbc
SHA256

595a57e5444395da080d4eba13099e471bad7a1eaba0d2506b581353402b90ba
SHA512

473222086cb96d64a402127feb280dc9edaf0d926c08dc87b7c97da3a6dea1568275dc56b1d06cc9a95a81f5a8ff5e53d038c153c8d171b8c8c6c908609aa6e5
SSDEEP

6144:0eux6nSU/j4B/dspchSnW8NVOo1qu/3PxhKNEjN:luxclK4nWyZ//xQNEjN

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4588	Update.rar

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7b9649882cc177e14b7dd0d368a7bb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.rar

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 4588	3916	ea7b9649882cc177e14b7dd0d368a7bb_JaffaCakes118.exe	82
PID 3916 wrote to memory of 4588	3916	ea7b9649882cc177e14b7dd0d368a7bb_JaffaCakes118.exe	82
PID 3916 wrote to memory of 4588	3916	ea7b9649882cc177e14b7dd0d368a7bb_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\ea7b9649882cc177e14b7dd0d368a7bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea7b9649882cc177e14b7dd0d368a7bb_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Update.rar
  C:\Update.rar
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Update.rar

Filesize
279KB

MD5
44c5bb4bacdafc933eab67e3fbdf41a3

SHA1
3eb17519b64195a29f237d5c5af6b22a3a7cfe7d

SHA256
cb68703af12d84a3a906ce34bfd592b30bea89715bfb7c897a84fb3a04155c58

SHA512
b4e3551784a4a8b84828691e910a980cdb138a9b76828c13f84fb3c3cec3261e2ab82bd003b1a2f1a60532ed4e6e6b01e54736caf41c6720645306ac9d3b86cf

Download Submit