d746cabdca2c8d97c6f3ec9c793a2aca742d8eb008d0cfcbbbbb9e60508338a4

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09426f3d32fb7b7b3ca3981976d637a1_JaffaCakes118.exe
Size

159KB
MD5

09426f3d32fb7b7b3ca3981976d637a1
SHA1

1362871178960f30d4f674fa11ee9a98ac7b0272
SHA256

d746cabdca2c8d97c6f3ec9c793a2aca742d8eb008d0cfcbbbbb9e60508338a4
SHA512

5d5e8f5ff86dce134b6d7a1a018758f0a3f4fa97f6fe5116a1e8ea6745838a4ebea62af5e35d073c4d5eb085a305629db716b5286b9f3bfa2e2ef0831d3f3bfb
SSDEEP

3072:f22ihA0m3BJf0AtDtBHo5V3h02UFZKeNGwQnAvv9Im:QA0m3T0AtDtBHwRUzETnAvv6m

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2340	biclient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09426f3d32fb7b7b3ca3981976d637a1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biclient.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2340	biclient.exe
2340	biclient.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 2340	3436	09426f3d32fb7b7b3ca3981976d637a1_JaffaCakes118.exe	82
PID 3436 wrote to memory of 2340	3436	09426f3d32fb7b7b3ca3981976d637a1_JaffaCakes118.exe	82
PID 3436 wrote to memory of 2340	3436	09426f3d32fb7b7b3ca3981976d637a1_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\09426f3d32fb7b7b3ca3981976d637a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09426f3d32fb7b7b3ca3981976d637a1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\AppData\Local\Temp\biclient.exe
  "C:\Users\Admin\AppData\Local\Temp\biclient.exe" /initurl http://bi.bisrv.com/:affid:/:sid:/:uid:? /affid "ffonts" /id "popstarregular" /name "popstarregular" /uniqid 09426f3d32fb7b7b3ca3981976d637a1_JaffaCakes118
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biclient.exe

Filesize
219KB

MD5
c66293ccd7cbe84b1b8f393ca5e4e6d7

SHA1
c24089d407e6280b79bec86532e9de0118e4de71

SHA256
ffbae29e2f233767fd42909720497165ce3552427ef93efb2fc714fb4204755f

SHA512
7ff97aa71f182035f90ba10c3bf8087280e3f34bf717bda139d642f4e043c64aa2b98d82a90a32f1df4b76f9d7610af62390fe934e514c90c703381a421c00b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\config.ini

Filesize
91B

MD5
b409b195ca2a01cb5b5c2f10d97b18f3

SHA1
b03a18eecee8b28c8a74bd2d4eaabb1828d9c938

SHA256
06cdde40fb9f502bb96d264058c21ffbe55ad5f98ff845ebfb2620a1c1e36fcb

SHA512
9d5921a139ae9ef3848263797da9522bc2c4968bb83407b48156b6aaabf4ebdbd82c36cd560228121bb57089de4d349983db18045da50435e8d4902ef28cc11b

Download Submit
memory/2340-15-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/2340-72-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/3436-13-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download