2c48ba33ed8578db8e607267c12c2cbe1f07052d3baf70324e50dca5e39cb8d1

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe
Size

1.3MB
MD5

f0a5c81459868d6ce0c3b03c5c84a7e9
SHA1

55a18bdf5366628676b9b9f29a65acd4de117d4b
SHA256

2c48ba33ed8578db8e607267c12c2cbe1f07052d3baf70324e50dca5e39cb8d1
SHA512

fc0ac0ff749070d3feaf66a83d3ddb1c4f4e453da4ae9e03cf6c95e5c0898fb57e172b11e112fd97bc8bba783736a886c6e560a1219a45c92a262490a198cf4b
SSDEEP

24576:OIKi6LC+juonYOai3AVQwyO5bzgZhYcUy2UV8UA7JypaZ4q1VEx:d7UCTZOt3AVrySbUDuUGZP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3444	svhost.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 3444	400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe	82

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe
400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe
400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe
400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe
400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 3444	400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe	82
PID 400 wrote to memory of 3444	400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe	82
PID 400 wrote to memory of 3444	400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe	82
PID 400 wrote to memory of 3444	400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe	82
PID 400 wrote to memory of 3444	400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe	82
PID 400 wrote to memory of 3444	400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe	82
PID 400 wrote to memory of 3444	400	f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0a5c81459868d6ce0c3b03c5c84a7e9_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
1.6MB

MD5
1c9ff7df71493896054a91bee0322ebf

SHA1
38f1c85965d58b910d8e8381b6b1099d5dfcbfe4

SHA256
e8b5da3394bbdd7868122ffd88d9d06afe31bd69d656857910d2f820c32d0efa

SHA512
aa0def62b663743e6c3c022182b35cff33cb9abf08453d5098f3c5d32b2a8b0cd1cc5de64b93e39680c1d1396fef1fd50b642ca3ea4ba1f6d1078321d96916ab

Download Submit
memory/400-0-0x0000000074C02000-0x0000000074C03000-memory.dmp

Filesize
4KB

Download
memory/400-1-0x0000000074C00000-0x00000000751B1000-memory.dmp

Filesize
5.7MB

Download
memory/400-2-0x0000000074C00000-0x00000000751B1000-memory.dmp

Filesize
5.7MB

Download
memory/400-9-0x0000000074C00000-0x00000000751B1000-memory.dmp

Filesize
5.7MB

Download