443a165f4ef1e448c158f116928d761f3711a4ec9058cd68f5f30c98773b52f7

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d9229dfafc8a8f7106a787f80b7a167_JaffaCakes118.exe
Size

1.9MB
MD5

3d9229dfafc8a8f7106a787f80b7a167
SHA1

7dbcc1b287347b9f8c99cdc867b2cde1a4cf52fa
SHA256

443a165f4ef1e448c158f116928d761f3711a4ec9058cd68f5f30c98773b52f7
SHA512

756da65b063e9d5a80bc61722856262032d8feae1b2f96f13dd2d381a8630358fb2b2ef6090e25f7308180b16c54f0070437884646e2dc477df39334bab410ad
SSDEEP

49152:Qoa1taC070dqaM6ibf66WfmCBngue1lCUFtOh:Qoa1taC0ZaMhbZ2mCBngX6UFte

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2528	AEED.tmp

Executes dropped EXE 1 IoCs

pid	Process
2528	AEED.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d9229dfafc8a8f7106a787f80b7a167_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AEED.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2528	4852	3d9229dfafc8a8f7106a787f80b7a167_JaffaCakes118.exe	86
PID 4852 wrote to memory of 2528	4852	3d9229dfafc8a8f7106a787f80b7a167_JaffaCakes118.exe	86
PID 4852 wrote to memory of 2528	4852	3d9229dfafc8a8f7106a787f80b7a167_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3d9229dfafc8a8f7106a787f80b7a167_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d9229dfafc8a8f7106a787f80b7a167_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\AEED.tmp
  "C:\Users\Admin\AppData\Local\Temp\AEED.tmp" --splashC:\Users\Admin\AppData\Local\Temp\3d9229dfafc8a8f7106a787f80b7a167_JaffaCakes118.exe 742B1B0FC0D9ECC4B3858462FA8878A3EE19AC94E4309E746343C2ED5CA569FC710D5ED02E2B536B895337F9CD0B12D57D9B7A6A98A26D6DA4ECE6B2261B8333
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AEED.tmp

Filesize
1.9MB

MD5
2dfeffe800f5890723a50745b907e95a

SHA1
e6574ae41bc1dcc645cd82758d8de1c865250a46

SHA256
71ba10ec30242210232aacc9b9a36e5d8fd37a488e820cfad63f72f332a67bdb

SHA512
2acff233b74bb2d8a6cd49447850b1829f0ca5e3a80876f84a62d3112a5d805aa28df78380ad895bf8a7e6f48338fab3713460d4899c24af04bbda2e2f900843

Download Submit
memory/2528-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4852-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download