0ea37806c8959d54278ed2b51b1e00180173af7dd1e927a3968c59e7a706b6ae

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efee66984b52c8370b29d43b9e37f0dd_JaffaCakes118.exe
Size

410KB
MD5

efee66984b52c8370b29d43b9e37f0dd
SHA1

7babd73516b271a9f10679ee45a98703565904f5
SHA256

0ea37806c8959d54278ed2b51b1e00180173af7dd1e927a3968c59e7a706b6ae
SHA512

e2633cef69a546dd5a267bc5980a63a995b17e62920634a4b52f5954cc7147b959d35a08983ea95237fb6b54ec1d78ab99fab95d6b878e26625464d2202bef8e
SSDEEP

12288:CxIK9V14ImyHYeGt23at7GqBiucvmfGOlZSndhiq:CJEyY1t28tX7q

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
824	mfvjp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\mfvjp.exe"	mfvjp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	efee66984b52c8370b29d43b9e37f0dd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mfvjp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 824	4848	efee66984b52c8370b29d43b9e37f0dd_JaffaCakes118.exe	82
PID 4848 wrote to memory of 824	4848	efee66984b52c8370b29d43b9e37f0dd_JaffaCakes118.exe	82
PID 4848 wrote to memory of 824	4848	efee66984b52c8370b29d43b9e37f0dd_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\efee66984b52c8370b29d43b9e37f0dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efee66984b52c8370b29d43b9e37f0dd_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848
- C:\ProgramData\mfvjp.exe
  "C:\ProgramData\mfvjp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
410KB

MD5
1aee944023066df653456ec906cc73c5

SHA1
527121b9a62995be4d5d706623f8e70dcabe2fa4

SHA256
fa3f2160e77c1db3c703d177a79cc50984f2d6cc8a834bd966b66dcd3c8e99d0

SHA512
a56e1fd0c9631f437524e3bbe763bada21b6d57caabb559517292715b523cc7efc13af654e333cd6dc0732325b70c64024877c0c29417dabe60ba10f63567b34

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
150KB

MD5
a52d6cb53c4c31e9f5ad53a356adf9dd

SHA1
4e9b2d208dc3c3a6e23decb0a7d7381c73f7b101

SHA256
f6bc441488529eadccfef115d11fa10c5cb8cb125b6c08c52a2bbc144bd4f7d8

SHA512
6d86153ffb8c803092d4fe30f1df1371657023eb10fd56dfeca684ff13a3222f64b11592576d3990f14cf915987a3372cf89774f811ef33dbd5f1b7db5ba681b

Download Submit
C:\ProgramData\mfvjp.exe

Filesize
260KB

MD5
3e4f7f469a320af55b299f84643bcd91

SHA1
507098b23efc7f8a84a41558424e0442ad6b734a

SHA256
89942634bc7d0d962fceaf0ba40a19fa128427238a822424265e30f2836a971b

SHA512
0c0ec1cb6d3e9be06caaae368d512da32e919cd3f409b29479dff41d01689738e64fefc5d13840c7accef9dd668ec3ae91553ecaefc87939e8f1e3c78d7c5da2

Download Submit
memory/824-130-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4848-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4848-1-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4848-9-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads