e1afb21b699a25b8c31493f82b6e4689a2d9945ca64f848e48d8e270a0501007

Analysis

max time kernel
117s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead2d46f03875d1f0e8b4ad0e1571f31_JaffaCakes118.exe
Size

296KB
MD5

ead2d46f03875d1f0e8b4ad0e1571f31
SHA1

dc4732250c5617fa3552dec1fcc90155c116e092
SHA256

e1afb21b699a25b8c31493f82b6e4689a2d9945ca64f848e48d8e270a0501007
SHA512

6a31b0e0c069f2cc572e33ff4dcc1dcd941256cac2ac39ae26faaa4e827b09c3184bd2c104a5a962815435968ba62b398cdf6e418790f3a2f2b55868a4e7685e
SSDEEP

6144:rUF6pAhaE6OWTm6pdVD2lyT/7jUd9/p8hI+te1AawYjs/oS:rUQNrLD2lybPUv/EIMVawpoS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3140	com.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\com.exe	ead2d46f03875d1f0e8b4ad0e1571f31_JaffaCakes118.exe
File opened for modification	C:\Windows\com.exe	ead2d46f03875d1f0e8b4ad0e1571f31_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ead2d46f03875d1f0e8b4ad0e1571f31_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	com.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4348	4968	ead2d46f03875d1f0e8b4ad0e1571f31_JaffaCakes118.exe	84
PID 4968 wrote to memory of 4348	4968	ead2d46f03875d1f0e8b4ad0e1571f31_JaffaCakes118.exe	84
PID 4968 wrote to memory of 4348	4968	ead2d46f03875d1f0e8b4ad0e1571f31_JaffaCakes118.exe	84
PID 3140 wrote to memory of 3648	3140	com.exe	83
PID 3140 wrote to memory of 3648	3140	com.exe	83
PID 3140 wrote to memory of 3648	3140	com.exe	83
PID 3140 wrote to memory of 3648	3140	com.exe	83
PID 3140 wrote to memory of 3648	3140	com.exe	83

C:\Users\Admin\AppData\Local\Temp\ead2d46f03875d1f0e8b4ad0e1571f31_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ead2d46f03875d1f0e8b4ad0e1571f31_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\RKDJTX.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4348

C:\Windows\com.exe
C:\Windows\com.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" 83453
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RKDJTX.bat

Filesize
218B

MD5
8e7543d96aec057a408b754ca3d37a59

SHA1
3ff76dc14e09e5e8f6781298cda410485c844338

SHA256
470f51c121bac6e930f5adbb07a8e5d91d610f463a2f59b32f8b416699f2411e

SHA512
ed830a53c5bd0cdf5029009720130f354a7efa5b02e9e38a5b9622e8cbad1aac2bdf3666102b70f513c8c58cd24fd0c6881da20fded2ede2eee74b7f9ad2c7de

Download Submit
C:\Windows\com.exe

Filesize
296KB

MD5
ead2d46f03875d1f0e8b4ad0e1571f31

SHA1
dc4732250c5617fa3552dec1fcc90155c116e092

SHA256
e1afb21b699a25b8c31493f82b6e4689a2d9945ca64f848e48d8e270a0501007

SHA512
6a31b0e0c069f2cc572e33ff4dcc1dcd941256cac2ac39ae26faaa4e827b09c3184bd2c104a5a962815435968ba62b398cdf6e418790f3a2f2b55868a4e7685e

Download Submit
memory/3140-6-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download
memory/3140-7-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/3140-13-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download
memory/4968-0-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download
memory/4968-1-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4968-11-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download