3b81305d7d3845f1bb1d7d4c745d6395799ff4ddf8f39dad974e2fce2211b650

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5078b24923b15b145da0bedf57a4ea7_JaffaCakes118.exe
Size

272KB
MD5

f5078b24923b15b145da0bedf57a4ea7
SHA1

379626db17375c6806168a61fcc30d13f92b0666
SHA256

3b81305d7d3845f1bb1d7d4c745d6395799ff4ddf8f39dad974e2fce2211b650
SHA512

c4df6de78ca126d99dca1a03bea9a75cc16dd2945132746d318e8e06182134c7a725cb30b77813df2c684503818f4801aca27ac3a4444aeaf42d8e83846338b3
SSDEEP

6144:Rl4n7I2sUIVm7eQsB41rdUy7X7Xf9++OLWGQEl0U:RSn0+IVfb+pUIXDMiKb

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3980	G_Rotsyou.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\G_Rotsyou.exe	f5078b24923b15b145da0bedf57a4ea7_JaffaCakes118.exe
File opened for modification	C:\Windows\G_Rotsyou.exe	f5078b24923b15b145da0bedf57a4ea7_JaffaCakes118.exe
File created	C:\Windows\Delete.BAT	f5078b24923b15b145da0bedf57a4ea7_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5078b24923b15b145da0bedf57a4ea7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G_Rotsyou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3980	G_Rotsyou.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3356	3064	f5078b24923b15b145da0bedf57a4ea7_JaffaCakes118.exe	91
PID 3064 wrote to memory of 3356	3064	f5078b24923b15b145da0bedf57a4ea7_JaffaCakes118.exe	91
PID 3064 wrote to memory of 3356	3064	f5078b24923b15b145da0bedf57a4ea7_JaffaCakes118.exe	91
PID 3980 wrote to memory of 3168	3980	G_Rotsyou.exe	90
PID 3980 wrote to memory of 3168	3980	G_Rotsyou.exe	90

C:\Users\Admin\AppData\Local\Temp\f5078b24923b15b145da0bedf57a4ea7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5078b24923b15b145da0bedf57a4ea7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Delete.BAT
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3356

C:\Windows\G_Rotsyou.exe
C:\Windows\G_Rotsyou.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:8
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.BAT

Filesize
214B

MD5
fee58e26ff374fcbc1442c0db82f4a48

SHA1
5fb4ea58f402dadd5b08f802b470fc7f660ab1b4

SHA256
24bdaf93832732be4b8abd0b3bde08d403a48fcf843521bf96754a7882194920

SHA512
c45ac0089385f83901849a03ae458be9749a19d950f96de8d8375b0561744e5542292276894c8290ad8c6e254bac5c3c28bd1afb6e90e2a6a76949804e950f7a

Download Submit
C:\Windows\G_Rotsyou.exe

Filesize
272KB

MD5
f5078b24923b15b145da0bedf57a4ea7

SHA1
379626db17375c6806168a61fcc30d13f92b0666

SHA256
3b81305d7d3845f1bb1d7d4c745d6395799ff4ddf8f39dad974e2fce2211b650

SHA512
c4df6de78ca126d99dca1a03bea9a75cc16dd2945132746d318e8e06182134c7a725cb30b77813df2c684503818f4801aca27ac3a4444aeaf42d8e83846338b3

Download Submit
memory/3064-0-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/3064-8-0x0000000000400000-0x00000000004B1278-memory.dmp

Filesize
708KB

Download
memory/3980-5-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/3980-11-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/3980-10-0x0000000000400000-0x00000000004B1278-memory.dmp

Filesize
708KB

Download