f59ef120dd7953d0d0cbaaec3d64a84806f18e0addd34651a97dc3f4c6ff4519

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 07:02

Target

097427b67ce45ec2eb4340bc693c0b21_JaffaCakes118.exe
Size

55KB
MD5

097427b67ce45ec2eb4340bc693c0b21
SHA1

3043f6c574310d4e2751ca6c43a18d97c63494e8
SHA256

f59ef120dd7953d0d0cbaaec3d64a84806f18e0addd34651a97dc3f4c6ff4519
SHA512

8f1559ca043082428d2cba7df5bbb72a13caceccc3ba4ed7f2ff1c39ad29a36f899e6fb00a7d84e503c5d45f700efd400e2a012a9b757bd79f63d447494441a3
SSDEEP

768:uMcmmZCAWgcg4QGZk4XAgyr2/qDWghtNyn6SEZwwuVbW1+Kx9Y6p83vX7JX2ifC3:ummZCAWg94Q2k4XYxlSo+/LJ8F

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	097427b67ce45ec2eb4340bc693c0b21_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
872	097427b67ce45ec2eb4340bc693c0b21_JaffaCakes118.exe
872	097427b67ce45ec2eb4340bc693c0b21_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 4368	872	097427b67ce45ec2eb4340bc693c0b21_JaffaCakes118.exe	82
PID 872 wrote to memory of 4368	872	097427b67ce45ec2eb4340bc693c0b21_JaffaCakes118.exe	82
PID 872 wrote to memory of 4368	872	097427b67ce45ec2eb4340bc693c0b21_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\097427b67ce45ec2eb4340bc693c0b21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\097427b67ce45ec2eb4340bc693c0b21_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninste5799b0.bat" "C:\Users\Admin\AppData\Local\Temp\097427b67ce45ec2eb4340bc693c0b21_JaffaCakes118.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4368

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\uninste5799b0.bat

Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/872-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/872-1-0x00000000006C0000-0x00000000006D2000-memory.dmp

Filesize
72KB

Download
memory/872-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/872-6-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download