de599f4c0962f8ffc5fac2cada0bdbb59c19e2d454948de0ec9ba4a16766d1e1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe
Size

52KB
MD5

001b3c98108c5b8c3d4096cf4131976f
SHA1

610d2199bd3ee28ae0b3761158cdd0b628b2f4c6
SHA256

de599f4c0962f8ffc5fac2cada0bdbb59c19e2d454948de0ec9ba4a16766d1e1
SHA512

db55f0761d094b0b833299445953a5544ede7d42673b53525d2b615015b9c691630ff82e81d51feb9e2b054bad2aaabf68eeb1d72a152c75e5e95a05f0c40a63
SSDEEP

1536:IriwVekTuv1pfAF66cHd94//RY2zGlHygr:IjQfv1p6q9vyU

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2252	NTdhcp.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NTdhcp.exe	001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NTdhcp.exe	001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NTdhcp.exe	NTdhcp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Deleteme.bat	001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NTdhcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2252	4644	001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe	82
PID 4644 wrote to memory of 2252	4644	001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe	82
PID 4644 wrote to memory of 2252	4644	001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe	82
PID 4644 wrote to memory of 3880	4644	001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe	83
PID 4644 wrote to memory of 3880	4644	001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe	83
PID 4644 wrote to memory of 3880	4644	001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\001b3c98108c5b8c3d4096cf4131976f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\NTdhcp.exe
  C:\Windows\system32\NTdhcp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Deleteme.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Deleteme.bat

Filesize
212B

MD5
bea35de71d357b78c37f2bda70ccc159

SHA1
e765c3fdf3877ceb679a0a589a8236645f399138

SHA256
4e35e9592662f5006c20384005b76128094889627c8a5dcdabc25f8a9b568b9b

SHA512
67cf32bb8a6b0549805c32c46597a20ae31301e9a265234504c896da87d9de5f62fb998952ad4fd99f54f661ce8d7d4f5703843d0c6714e40891e83f9590e872

Download Submit
C:\Windows\SysWOW64\NTdhcp.exe

Filesize
52KB

MD5
001b3c98108c5b8c3d4096cf4131976f

SHA1
610d2199bd3ee28ae0b3761158cdd0b628b2f4c6

SHA256
de599f4c0962f8ffc5fac2cada0bdbb59c19e2d454948de0ec9ba4a16766d1e1

SHA512
db55f0761d094b0b833299445953a5544ede7d42673b53525d2b615015b9c691630ff82e81d51feb9e2b054bad2aaabf68eeb1d72a152c75e5e95a05f0c40a63

Download Submit
memory/2252-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4644-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4644-9-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download