a30c050d5c41a945070a45ed9b547fe0d9def41a86a09cb6ca600382faf64099

Analysis

max time kernel
142s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe
Size

1.8MB
MD5

5205816a750cb86b88614ea22faa75b3
SHA1

3baadad2368136bcff6fcb8af87b6cc00aa9b6cb
SHA256

a30c050d5c41a945070a45ed9b547fe0d9def41a86a09cb6ca600382faf64099
SHA512

1d499bbb3b1eba26953f046e46ef23f6d407f958f0add500efb5d934e264042328434731a61d9f8cd00e33b5551f1190c02c52278af3d6e03a0a491c9fbd3ec4
SSDEEP

49152:+JoY1Zt0lF/80bvurP1mDufYZ0MynTW3B:artkW0bv+9fGynQ

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2852	5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe
2852	5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 5088	2852	5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe	85
PID 2852 wrote to memory of 5088	2852	5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe	85
PID 2852 wrote to memory of 5088	2852	5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5205816a750cb86b88614ea22faa75b3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c \DelUS.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DelUS.bat

Filesize
228B

MD5
074b268456dbdfd4cf77824701bf00fe

SHA1
9fd6d14a90d2695bcda865ef4541c41ccd8dd4dd

SHA256
7123f9d0c5b3a03e66afd5b1ee1d65a7befe7aa4b4a028bc36a7df9604d59096

SHA512
4a9dff90a22b429d102e3f73fad236d717e1ce8ac71c78143f0be830119a10a61465a9056c359b00ac679de486f58e146e86bfeebe2de96a1723e1723891e9c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8C05.tmp\ISCHECK2.dll

Filesize
92KB

MD5
9b758e25eeb7298a61776391310a11f7

SHA1
5f05ac39f0027197e391e0ef43a3ef9ec160426a

SHA256
7e58ea6ce4c690eb69b16cb1260a9d7127fcb6cdd43cfa1f360571607d9b9a9e

SHA512
23f1236a0181b3735e4f311781c236b78883f8f76ee3b3ba0cd2ab6836a7977d8ea4ff16546d00d5419ed4190e584d4ceeba2389ed9c4325a84d468ee883895c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8C05.tmp\SelfDelete.dll

Filesize
24KB

MD5
7bf1bd7661385621c7908e36958f582e

SHA1
43242d7731c097e95fb96753c8262609ff929410

SHA256
c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e

SHA512
8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f

Download Submit