6872887224bc4d6a22ca724863d0bdeb35f846d55782942f4596d44af36a7552

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe
Size

236KB
MD5

3f580e867d742fb25b4ffe3503b1b85a
SHA1

c8e958766b597eacff0080a6f71b8e8b3d08f031
SHA256

6872887224bc4d6a22ca724863d0bdeb35f846d55782942f4596d44af36a7552
SHA512

3732aa7589a32a8448da28b007fead68de70df3d68e8bcc6117dfe96a6d22948edaf300ac0012008bce64a9c57862b39c20f2829c0e278cdaebd2f8bfcb729a2
SSDEEP

3072:+fbA7uidA7AyemWvik8STpUpbQ47+CcfIyZ+cjGtHKfYp:Tdw3Wi2T2tPPEZz6Hd

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4768	WinDDK.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDDK.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3108	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe
3108	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe
4768	WinDDK.exe
4768	WinDDK.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4768	3108	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe	84
PID 3108 wrote to memory of 4768	3108	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe	84
PID 3108 wrote to memory of 4768	3108	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3108
- C:\WinDDK\WinDDK.exe
  C:\WinDDK\WinDDK.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WinDDK\WinDDK.exe

Filesize
236KB

MD5
c634ea1fb0c5ae3442d6b05458595a27

SHA1
1f0725d7d9d834dff91da167cb49aed4c91e2320

SHA256
6c0ec2ebd4c582f3b9e91a00c8acb773060b313cd36e9090ad6006d3465d23f1

SHA512
ae30fece2fd9ac79c0280dc27b72d27ff54348e15a7ab0114eabc54350a4060a6233dd73178ca75d2ae53ee2cf9be98903334f29f63b91b4ab64c5d71a64b25c

Download Submit
C:\WinDDK\tmp-0.bin

Filesize
8KB

MD5
d4a4c8d0d3f12d15e49e00b0ad3bdaa1

SHA1
59a5f8e38a8b35e126091cc59bec4ccfc94d67c3

SHA256
a4353777cb0ca3d1a576b8fd820d07472fda17e7ce09733174ca0e5843ee2869

SHA512
ed9adaa640c26f893cd83eb1372558d596c5655015c9aafde308c24ddca60765e3e35c5549314ab3355469efc28860026d449ec65fef0e0e06e2c98223f45ab2

Download Submit