c2dbdf90e75290d41a10984697e53b07fbe4d0031abcc7c7748148e57896965e

Analysis

max time kernel
141s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe
Size

1.2MB
MD5

162251d1d5d041acfd68a3d28bfc71f3
SHA1

a898bfdc54bf4cfa03e10f155d4c73fe05ffbfaf
SHA256

c2dbdf90e75290d41a10984697e53b07fbe4d0031abcc7c7748148e57896965e
SHA512

a6f9f94aeebe65c76d15aacc4adb4c4d51a2246563c7fe531dd384f4f89e8b3fe857b44e46ed00e2435291d80449078f64e8d27c8670323494021b70c31803f9
SSDEEP

24576:qkAwC3ZWenixkkkNVEEgeY/VhTU0oci5/WOAMVL98dyPFjK:bkJPcEFD0oDVWji+dYFjK

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3924	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp

Loads dropped DLL 1 IoCs

pid	Process
3924	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3924	2940	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe	89
PID 2940 wrote to memory of 3924	2940	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe	89
PID 2940 wrote to memory of 3924	2940	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\is-56HQ3.tmp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-56HQ3.tmp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp" /SL5="$702C2,955221,51712,C:\Users\Admin\AppData\Local\Temp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:8
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-56HQ3.tmp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp

Filesize
693KB

MD5
8043631ef861d1eb646331cf93293b1f

SHA1
6b6b031842b16c5cb51a6269fe56dd9e3ee8df7e

SHA256
21331a4a3acc8690e8c60b060f29f91705a917ace48c7c032385171ae1c2d1a8

SHA512
426c3dd1e12088484cef3c2ce75fe819cb0ae7ea4f5619110dc021493ca9fc083f9c252b928c8c565db3f779ecaba20fb655e0eaa70221b74fe3d0f7de2a01bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FE2CM.tmp\webctrl.dll

Filesize
8KB

MD5
d0372bedb70710aeff382818ad683f54

SHA1
f960deffdde9cd5cb5fd3608185a49a91d398f3e

SHA256
b3daff58c8e7ca8ce6fe155ca78c681a7d3144a538c3ed4c2913e91a1d2bd717

SHA512
4b24a990ba155b664bad58884810123898f99f3ffe3d9704662c9576d31d60f1889c7a368589af7c3c9559e5fb9921cf87bc4faf73b4b83d1262b50c9bb5f706

Download Submit
memory/2940-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2940-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2940-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3924-7-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3924-18-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download