fd1e4fc98d8717b94d2c10760b9d303eeb7106ef239724902578f5650dc76e4c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe
Size

81KB
MD5

3ccbcc2a7e84dff7b6de6a5ff8fa10b6
SHA1

410040416b6dd309e3bcd1e52ca303746eb38f34
SHA256

fd1e4fc98d8717b94d2c10760b9d303eeb7106ef239724902578f5650dc76e4c
SHA512

a9d5dd776d6756124734af23f1593ac034c47c2bb9bd05135a3345a7cad88fab8f619340ad85e3c4750566baa026b26bcdcbe6d459f3b24c19515349d3649c5f
SSDEEP

1536:Sr2i8CodyfxxaFt9fMJKKbzkf14o39TJ4W/iejqa1V:SX8CG9TUdHE4K914W/7jq0V

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4784	3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4784	3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
372	3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
372	3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe
4784	3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 4784	372	3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe	85
PID 372 wrote to memory of 4784	372	3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe	85
PID 372 wrote to memory of 4784	372	3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:372
- C:\Users\Admin\AppData\Local\Temp\3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3ccbcc2a7e84dff7b6de6a5ff8fa10b6_JaffaCakes118.exe

Filesize
81KB

MD5
47aea0360e25de051394afabf5333e97

SHA1
3bbc4474e10252f785c8480773b3d158258b5b62

SHA256
9d0d557675604847f639f1e6646fd9e6a82ecac0fa66b6d3630b527f1ec24c29

SHA512
5debebe9c18128fcbc0a9ad62129b44dbabfd9c807d69eb9e821a5d3a7176309f9bba38a6a382a9bd8e0f3899b215550729787ceddaf6b425fc6db3b1c01fd10

Download Submit
memory/372-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/372-1-0x00000000001C0000-0x00000000001EE000-memory.dmp

Filesize
184KB

Download
memory/372-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/372-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4784-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4784-25-0x0000000001500000-0x000000000151B000-memory.dmp

Filesize
108KB

Download
memory/4784-14-0x00000000000E0000-0x000000000010E000-memory.dmp

Filesize
184KB

Download
memory/4784-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4784-26-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download