7b70b1f3bc7d86342c3545d7c05653c20899273b76d65b3a82fb89d2bd81918c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.exe
Size

1.6MB
MD5

1244f952f7b837d18e23e6099b4c2455
SHA1

9ec759180f2caee8c6bc1b15cf9d3879a3ccff5b
SHA256

7b70b1f3bc7d86342c3545d7c05653c20899273b76d65b3a82fb89d2bd81918c
SHA512

878d6d14fe450895d019f94ef20e3f809cf2024da01ef673f5057615be2d2f3a5afd05e384c943ef2090173e106342a32f956a6cbea3b3a010ee072f02fc3fa3
SSDEEP

24576:sBWRYMfF6wAP6TuRz7JZXLJYQUIx0MKLLf4ltCOqCMCdM9x7VNrxaDKUw9Yj26IT:JV6jDnJYEx0PSvzMPjrwA/p

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3824	1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.tmp

Loads dropped DLL 3 IoCs

pid	Process
3824	1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.tmp
3824	1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.tmp
3824	1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 3824	4544	1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.exe	82
PID 4544 wrote to memory of 3824	4544	1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.exe	82
PID 4544 wrote to memory of 3824	4544	1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\is-V0GTD.tmp\1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-V0GTD.tmp\1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.tmp" /SL5="$602C2,1211014,488960,C:\Users\Admin\AppData\Local\Temp\1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-HP46Q.tmp\AppsetOfferImage.png

Filesize
47KB

MD5
eb381c517f711d1a485b8f2488de479b

SHA1
e6fa37670712511f0a9c08f5f20fc7bc259f7f23

SHA256
c0ebbf9b8a7bc9847fc3a538277f49446e30e899308c1799c502a4547c2266fa

SHA512
9645501241cfe0d7340e03d6d5fcb6ddee2f8e2d873801c4bbdbb843cf1d332a8d413a4cfa6548f1707a2604acc19d1843dc1e698ec5ef1711a96d3d55015353

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HP46Q.tmp\NativeUID.dll

Filesize
86KB

MD5
d47e7649fc7b9bd91c7d091fde71b889

SHA1
19f11f2135982df97b9fda8fa5c9ce7813c99b1e

SHA256
a2583dbfd24d9061954dc185d1d5e43cff71ccc1342c6e87d7c349b70e8fa9ab

SHA512
262510f7ced40dc69e804a2b675b71a2ca25e9195428a55537c6dc3a7845bdcc8a8273e83a439bac05bc15bb4d194810cdda2b08678a6a9cd8a0b5eb628f1017

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HP46Q.tmp\Ya_distr_342x422.png

Filesize
12KB

MD5
b273649b75d640ccd6921e22f7016566

SHA1
bada8845019c51035c4728d221505524014dfdf1

SHA256
632bce31329fb202b24a76ca7cc15264bd88562de9b41783d9cb61154c6d78bb

SHA512
529b824dfe32e4ebae4be35812a96a05f6869c5f928d121dd1b78573d893aa04320cc8d6d3a3026509456de8c33ff98d891117e96323ed08e3797472ba18f726

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HP46Q.tmp\botva2.dll

Filesize
41KB

MD5
ef899fa243c07b7b82b3a45f6ec36771

SHA1
4a86313cc8766dcad1c2b00c2b8f9bbe0cf8bbbe

SHA256
da7d0368712ee419952eb2640a65a7f24e39fb7872442ed4d2ee847ec4cfde77

SHA512
3f98b5ad9adfad2111ebd1d8cbab9ae423d624d1668cc64c0bfcdbfedf30c1ce3ea6bc6bcf70f7dd1b01172a4349e7c84fb75d395ee5af73866574c1d734c6e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V0GTD.tmp\1244f952f7b837d18e23e6099b4c2455_JaffaCakes118.tmp

Filesize
1.5MB

MD5
39ce288ba1bc6c271007814c843e7409

SHA1
686c00e2acd32b5b5f3d2416415962df9b2f9e1b

SHA256
5853ecc27de9ba3db5eef3c423f567705cf4bd174bf69146a183dc303bdaf805

SHA512
b105df21621b6b2a899d23c222d2bb9df5bcdd85bac2b520de1ffabb7e5e92ca414f2ddfa61152653689c875c60d3087647c900f6133896bab585bbde702436b

Download Submit
memory/3824-6-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3824-18-0x00000000060C0000-0x00000000060CF000-memory.dmp

Filesize
60KB

Download
memory/3824-35-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3824-36-0x00000000060C0000-0x00000000060CF000-memory.dmp

Filesize
60KB

Download
memory/4544-1-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4544-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/4544-34-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download