6cfc3845bb6d44287fa57aaf53773df66a81c28c07c078c2cb0716d6045ffc63

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe
Size

387KB
MD5

0596bcf08e3dbd5cab5f18a49f7080be
SHA1

af14f1c0394bd7a3da119da3a18799aa32a8e836
SHA256

6cfc3845bb6d44287fa57aaf53773df66a81c28c07c078c2cb0716d6045ffc63
SHA512

816906f5dfe74ed14256abb380685974a14eb24b1f1c5d992ee77789eff817a4b20c0f97bfec4ebed10f56ebb9c8378e022ad37c4e43e1fc6c2a5cd348e92a5c
SSDEEP

6144:MVeZmjW9FyRTBDeeqqjOLbqF/xijf0Oeo7Y0XoO1CH+XAgVmpnX2csU088TF9:vo69FIDehnKF8jfBxtoDH+QgoX2TNh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1680	setup.exe

Loads dropped DLL 3 IoCs

pid	Process
1680	setup.exe
1680	setup.exe
1680	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1680	1088	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	82
PID 1088 wrote to memory of 1680	1088	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	82
PID 1088 wrote to memory of 1680	1088	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	82
PID 1088 wrote to memory of 1680	1088	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	82
PID 1088 wrote to memory of 1680	1088	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\86F3\setup.exe
  C:\Users\Admin\AppData\Local\Temp\86F3\setup.exe 00010802
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\86F3\cdnins.dll

Filesize
84KB

MD5
3ae0ad5d8739fe943c62fa507c5ed977

SHA1
daf7e69cea771a21c5e9294dd03b04eb2cb8cd1a

SHA256
7791850ce7ec2d94ded3bd89b7b397cbcaddac35771bed4b9fc12d2742466c09

SHA512
3e778cecc59e25e5fe3ea86cc453e2a3afff40eab7aaf6e4f1a4e8abda801f912496051eaf2449a00fc9e148fafdc62193d69c02dada7e2bde6cb5cefe82e506

Download Submit
C:\Users\Admin\AppData\Local\Temp\86F3\cdnprh.dll

Filesize
72KB

MD5
4152d00fe6e6fb2637f6207571a1eb63

SHA1
bd433d41d04711b76084e996c5dcb753100788e8

SHA256
37b8420ef45e7cd6c1426388411beb301a2b2e59d8e83a68d0fcf06e4d7df6a2

SHA512
ced579aa67009aa30fe0b54fc8a4fcd7f0aa3b8679e65f9fc52a7fa1f020e31f23fb8d579466ce1985b4ead02275f2b7af757a18f66bf7654fcb4d9abb2449de

Download Submit
C:\Users\Admin\AppData\Local\Temp\86F3\setup.exe

Filesize
28KB

MD5
b9d4e392e8ac6a4420f126cc88d8c0c1

SHA1
3fa9755060979a13973927906222a4929bb4c80f

SHA256
3d20d973651546be8d370ff9013bbdc03282808a212731b92852f0b789634064

SHA512
03fe62e90efaa0cf064c335d7dd4df912f738a85726eb77269687f398511b883400eb0b95d3a8158d2a5b7fec37e073bbde754a5b53e17732b18f667d9960128

Download Submit
C:\Users\Admin\AppData\Local\Temp\86F3\src.dat

Filesize
144B

MD5
84f9db21363fccb7bd760eec95492afc

SHA1
9672840deb2654cd91c2587b58d9e665af1bb2ed

SHA256
0f5b7426e74046d8c4f501274442f4830777b97547f95b96d857cab58b4fa7d9

SHA512
4d47f413ea13e402c7ba9feee8c9ecaea4e75a29968c8bb876752f02672a23739f5f702b8581fe6ef26d4251d606458db70b16d2b3ffb2f641b399008ee7d933

Download Submit
memory/1088-0-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1088-30-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download