c68464d9a8146e06ca9cedaf86a650046fe21236bb43f5b36ef30b1ea0f20a81

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
Size

771KB
MD5

3f43485292fd9371f5c50e8e1c24ae2b
SHA1

819f00a0646d28eba86f0e811b55da7c6ff59b41
SHA256

c68464d9a8146e06ca9cedaf86a650046fe21236bb43f5b36ef30b1ea0f20a81
SHA512

de7609a5d607417849345cfbd686477ee6d6d1f2f696fd39ed5497fd9eeaff1909d82543341d0c025cd54167c79e991e897fdf13c51130e33519c17bbe44c1f5
SSDEEP

24576:vZX/MbxR7RFghfqyb10hJaothZ2/T6FBBB:hMNFfgNh/ofT

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3420	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3420	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
916	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
916	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
3420	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3420	916	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe	84
PID 916 wrote to memory of 3420	916	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe	84
PID 916 wrote to memory of 3420	916	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Filesize
771KB

MD5
4553f01a59ae9289074e973f2f0f6f2f

SHA1
3eea584bd3b11598e401f1442f7b321ff9f3404c

SHA256
4f2bda5ba009ceae80dfb0112a5317916ed2eeb00f560df4fba2399199734e1d

SHA512
74676a764fbceca55559cde59a1983f251ff6077589fee1afeff7542479042bcd6ce4b3d30a02227a68a945f4e5ed959dfa088783562524718e4061d897ed72d

Download Submit
memory/916-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/916-1-0x0000000000150000-0x00000000001B6000-memory.dmp

Filesize
408KB

Download
memory/916-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/916-13-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3420-20-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3420-14-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/3420-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3420-27-0x0000000004F30000-0x0000000004F8F000-memory.dmp

Filesize
380KB

Download
memory/3420-41-0x000000000D820000-0x000000000D85C000-memory.dmp

Filesize
240KB

Download
memory/3420-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3420-42-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download