79e8183479bdb1630603005cd4a7b1072a420e7a70518fa76158beecb679cd8b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

275c9ab45167466aaee87bfe7d2dc108_JaffaCakes118.exe
Size

72KB
MD5

275c9ab45167466aaee87bfe7d2dc108
SHA1

66236a75e5a8cedd26e34fca24b22975a2eb6316
SHA256

79e8183479bdb1630603005cd4a7b1072a420e7a70518fa76158beecb679cd8b
SHA512

1231a4b22847db0fdf3f0113146e94aec7d54a822be68440a05faff23f44b7f498fe487d60a78fabf4210c0ae3455f9fe59876406a2a71aeb82c08ed474381be
SSDEEP

1536:SoLDYsacy7mHMowHjXJVlk33p7mn9xr4M59u5O4l:SoPyys5jXJA33pC9Fbu5O4l

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2132	dum.exe
2796	indigos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	275c9ab45167466aaee87bfe7d2dc108_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	indigos.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2796	indigos.exe
2132	dum.exe
2796	indigos.exe
2796	indigos.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2132	2332	275c9ab45167466aaee87bfe7d2dc108_JaffaCakes118.exe	84
PID 2332 wrote to memory of 2132	2332	275c9ab45167466aaee87bfe7d2dc108_JaffaCakes118.exe	84
PID 2332 wrote to memory of 2132	2332	275c9ab45167466aaee87bfe7d2dc108_JaffaCakes118.exe	84
PID 2332 wrote to memory of 2796	2332	275c9ab45167466aaee87bfe7d2dc108_JaffaCakes118.exe	85
PID 2332 wrote to memory of 2796	2332	275c9ab45167466aaee87bfe7d2dc108_JaffaCakes118.exe	85
PID 2332 wrote to memory of 2796	2332	275c9ab45167466aaee87bfe7d2dc108_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\275c9ab45167466aaee87bfe7d2dc108_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\275c9ab45167466aaee87bfe7d2dc108_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\dum.exe
  C:\Users\Admin\AppData\Local\Temp\dum.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\indigos.exe
  C:\Users\Admin\AppData\Local\Temp\indigos.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dum.exe

Filesize
16KB

MD5
20c9e5517049ecb25210150ae2cf8dc0

SHA1
b1bc6eb4de382145192fc0433980d725bd70d4e6

SHA256
fa1360c04f6aca1b3bf5ad31059d9d72a49da463be5696acd5bdd229aefb75ee

SHA512
42a803bf24fb2a9e2b193e1ed9af7a48846b18ba33787a45b9236231069a6a37a059319661d012ee485192595139f6a5a1065f97615c559a7234787eee1f64ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\indigos.exe

Filesize
44KB

MD5
00dd79d9fc2425831ff2b8123cad60df

SHA1
a5f08db844b3264d7d872d27bc7c15822b705416

SHA256
77758760919645fce8e85629a7719c4f2a6451d8ef309b817fc544ae1c83c4c6

SHA512
6d9980bafa5bed80e6bc6435655d83e9805c7df458f0dea8bb27852dfbdded60fddb53c958bcdc1c035953a279e5bb444abc50d01a1baf68452846a0afe62246

Download Submit