12da6d7a03d9e7d5001c8e44a32119ca650cebdea12479e107f418672a9e904e

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe
Size

104KB
MD5

f6b7a3208de8533b73f7c8efea0d1309
SHA1

5bbe0e89ad1eb377b1f7d12cf9a80d7070367896
SHA256

12da6d7a03d9e7d5001c8e44a32119ca650cebdea12479e107f418672a9e904e
SHA512

6e45a230bcee32b45122e9211b1bc84993b8731c8b48139109f8ad22efd289b1a9e678e02dfe45b6cdf295c249b85bcf36f32a393fb1a846b656f870d5fc0a4a
SSDEEP

1536:eNBT7/kjIbTiEdBbqx6bOZEYhJgA2foNnz33AhsKKK3Z8Qwwnouy8+EnLhSb4N2:YXM0yEdB2x5TI0nbAT344out+ELhSb4c

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2532-0-0x0000000000C20000-0x0000000000C62000-memory.dmp	upx
behavioral2/memory/2532-37-0x0000000000C20000-0x0000000000C62000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3880	2532	f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe	82
PID 2532 wrote to memory of 3880	2532	f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe	82
PID 2532 wrote to memory of 3880	2532	f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6b7a3208de8533b73f7c8efea0d1309_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\cscript.exe
  cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Downloader.log

Filesize
1KB

MD5
9fc8dacb64a4d0a708dd3b77926a60d9

SHA1
1b0fd54fde24690ea6ff2ee007564859de6779db

SHA256
c3144487d828df9ddbbb484dd33cc19c3e69ed66f11dd616e27eb4b86f05a1d8

SHA512
c1d7cbab07384442a5fec262ce3f27347fefaae9ac02e4fb10ef9ed9b98f4bc4457d11f71f2d8d04093a077b96db1b2edf7e3efc522af1cf600ca0ccc448e7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Downloader.log

Filesize
4KB

MD5
90826c889cf4063318dfb24b6ec967b0

SHA1
22c5aae8bbdf94ac06ade72860424077313d5ef2

SHA256
976721b85b5e5e40e5fdb5e8217273860f0d65d27b232e05e9b1e3b227569382

SHA512
5cdf34956d9725f49b694c8b64fb34d9371d588b6c35cd4751867fb45b48d5abbae7f9dc039670a42a6e010aa7628737f966a2b0eeba8ba5b410a3cb93dbbd74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Downloader.log

Filesize
736B

MD5
a4300e79db97571c2dc8f9418b09ab3d

SHA1
655e2055ae5eeb6b8edbd1b20f020148cc404f72

SHA256
ae35c023b8df88a06e53fa16c133f200f744453bd76282276160104a7808dfc3

SHA512
756997401a7919c1ee3057e5e640fc1887f1f66af1a219ae3eb9971239882a28d55a7f03fe2833209e3a967f6ec92b84432e26de2b97886454903ffcf2cc4098

Download Submit
C:\Users\Admin\AppData\Local\Temp\hd.vbs

Filesize
245B

MD5
d8682d715a652f994dca50509fd09669

SHA1
bb03cf242964028b5d9183812ed8b04de9d55c6e

SHA256
4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba

SHA512
eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca

Download Submit
memory/2532-0-0x0000000000C20000-0x0000000000C62000-memory.dmp

Filesize
264KB

Download
memory/2532-37-0x0000000000C20000-0x0000000000C62000-memory.dmp

Filesize
264KB

Download