2e94e7370eae22207d12bb83596a27e671fb7a7852dec0d245948c6016cd809a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe
Size

385KB
MD5

468c5a097c1038d9bfccc6ce4d3db7e7
SHA1

6da523318a74d65e76a42cdef26f04de0a08caab
SHA256

2e94e7370eae22207d12bb83596a27e671fb7a7852dec0d245948c6016cd809a
SHA512

0a7263c77457acefdc143b01233b0197ea4bb164eba1a0aca78ddaa2b33c21afcd6c2fc0a650b06058c45818e1e970a360a99a9f85bd92320574b5adc0534e52
SSDEEP

12288:nv4OHUywhIunempGW5tqVAZEI4CEJb9QMB:nN9W9BGstqFbCEh9QMB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3784	468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	pastebin.com
6	pastebin.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3644	468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3644	468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe
3784	468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 3784	3644	468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe	84
PID 3644 wrote to memory of 3784	3644	468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe	84
PID 3644 wrote to memory of 3784	3644	468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Local\Temp\468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\468c5a097c1038d9bfccc6ce4d3db7e7_JaffaCakes118.exe

Filesize
385KB

MD5
08a4c6b2746730fd600cdd56ee28d35d

SHA1
9b255988bf3cc2e73d920be6847aca9818f713e6

SHA256
3c45d8165e55c672a6a975b2d3c2d06c2e9c627297c55412e1b44521ae8241ff

SHA512
d24d675d85f25c2500c120af5e6e6d1f358b0ea0fd821dc7096ee9f4dada5e7eee03c55cb1194f70bdd1a90241eb2f299c79e062ee32742a8a657a14ae113faf

Download Submit
memory/3644-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3644-1-0x0000000001610000-0x0000000001676000-memory.dmp

Filesize
408KB

Download
memory/3644-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3644-12-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3784-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3784-19-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3784-20-0x0000000001650000-0x00000000016AF000-memory.dmp

Filesize
380KB

Download
memory/3784-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3784-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3784-40-0x000000000D820000-0x000000000D85C000-memory.dmp

Filesize
240KB

Download
memory/3784-41-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download