5bbe24c99a6d3de6f7084dbc3c3a38251f5460aebe216ce7cecf5f182e41b62f

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4582e543a793cd9d06a325321d474ca6_JaffaCakes118.exe
Size

162KB
MD5

4582e543a793cd9d06a325321d474ca6
SHA1

f73f276cc2e429c4060649555ee7d02835155a4b
SHA256

5bbe24c99a6d3de6f7084dbc3c3a38251f5460aebe216ce7cecf5f182e41b62f
SHA512

851bb0ac73a67b94971f38fc1ffc7318db3bc42f47a4d728b8d690c3fcab668b042f5f13029ea32ab20c4001b6d040ae725b4ad658ac9a05b064150559e8a41e
SSDEEP

3072:h22ihA0m3BJf0vsTG8obMLBAA1q9hKX8cSpLWjSFhDztQ51c0Mv8:CA0m3T0vsq85nehKiLWQW51c0ME

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2544	biclient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4582e543a793cd9d06a325321d474ca6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biclient.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2544	biclient.exe
2544	biclient.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2544	544	4582e543a793cd9d06a325321d474ca6_JaffaCakes118.exe	84
PID 544 wrote to memory of 2544	544	4582e543a793cd9d06a325321d474ca6_JaffaCakes118.exe	84
PID 544 wrote to memory of 2544	544	4582e543a793cd9d06a325321d474ca6_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\4582e543a793cd9d06a325321d474ca6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4582e543a793cd9d06a325321d474ca6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:544
- C:\Users\Admin\AppData\Local\Temp\biclient.exe
  "C:\Users\Admin\AppData\Local\Temp\biclient.exe" /url bi.bisrv.com /affid "download123azvi" /id "garenaplusxmlb" /name "garena-plus-" /uniqid 4582e543a793cd9d06a325321d474ca6_JaffaCakes118
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biclient.exe

Filesize
223KB

MD5
ac8f7611f353ca9803fad5ff81900678

SHA1
de33325e686c82c12db1f95f39e94ac746f5b5b5

SHA256
ef72a8db980a2c299006b1c32b6ab0a74fd00dfc131c6ae7f13b392adf4159cc

SHA512
75d7d0a106f8cc02cac734e34a4cccd97d814214c397e2c05eb00b95b4ef87d2ce60e368b8d418a9c5b330b239547d1d9555538b6a2c705040a746bdcb320571

Download Submit
C:\Users\Admin\AppData\Local\Temp\config.ini

Filesize
98B

MD5
e2150cd8fd0ba855ac75b2263dce6fc1

SHA1
d27c2d72cb777b4e28d8636b0da62dfcee04136b

SHA256
036a688619a33c1bec8eb5c8ee2c6c963d651011bf9c3080d3b307ee83731aaa

SHA512
8f6e8a49f41ea9bbe16ef3de136562fe3cdd7246bc47aba74ea4d85f2157eafe1d423fc68df9e5ff3bbaf0a06554f3497ccc8704d73b10cf811d1a012ef1d88b

Download Submit
memory/544-14-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2544-15-0x00000000014C0000-0x00000000014C1000-memory.dmp

Filesize
4KB

Download
memory/2544-71-0x00000000014C0000-0x00000000014C1000-memory.dmp

Filesize
4KB

Download