1112f6486ed0913bee8f8321871ff50279552f5245f407c9f92830a40ca82606

Analysis

max time kernel
95s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

131359f76e640ab6e4204f5ed9c4d115_JaffaCakes118.exe
Size

1.9MB
MD5

131359f76e640ab6e4204f5ed9c4d115
SHA1

ed660cd99e29b1edfe2b8ba53f985e26bad4dfee
SHA256

1112f6486ed0913bee8f8321871ff50279552f5245f407c9f92830a40ca82606
SHA512

344eccf48e0d8f9e96829043650d56643239d460111b83a89fb104d568d43c28ee8cdd1c435e5051422e61f3a5cece833b5c7a1f37cc626b7a3c08b3a9704ad0
SSDEEP

49152:Qoa1taC070drstVgfjXOh2k7HKKwssqnD/kNeWPk2jGWj8Zaqi:Qoa1taC0ZKXoLsqD5UiIOo

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4732	6215.tmp

Executes dropped EXE 1 IoCs

pid	Process
4732	6215.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	131359f76e640ab6e4204f5ed9c4d115_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6215.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4732	1856	131359f76e640ab6e4204f5ed9c4d115_JaffaCakes118.exe	82
PID 1856 wrote to memory of 4732	1856	131359f76e640ab6e4204f5ed9c4d115_JaffaCakes118.exe	82
PID 1856 wrote to memory of 4732	1856	131359f76e640ab6e4204f5ed9c4d115_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\131359f76e640ab6e4204f5ed9c4d115_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\131359f76e640ab6e4204f5ed9c4d115_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\6215.tmp
  "C:\Users\Admin\AppData\Local\Temp\6215.tmp" --splashC:\Users\Admin\AppData\Local\Temp\131359f76e640ab6e4204f5ed9c4d115_JaffaCakes118.exe EC195D321164069E2BC2B3CC0A2DCA21FB246063E8C47E7CB05085BE85691C8A3721F589F58FAF1A9B5158F83ECB7DADEB5A7BE82BAE8C5BEA67F55D8AC5101E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6215.tmp

Filesize
1.9MB

MD5
14842586be843aa1701d0480891e0e3d

SHA1
c8aa78ea31cde65b47fdb8273f13ef8bdf18c526

SHA256
6523e3108049c1ad733903d7b021863324516ae39cc8c29701337da26569b7e4

SHA512
047820c8f77b993c88c673ed8cbac6d789fec0e23fab812fa2c1bfa9c8977080c7cc9726044ad54b7453d9b6e12ae02b6bbe41aafe5b9123723243e3bd0dd8d9

Download Submit
memory/1856-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4732-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download