280a8cc97bef4ab031b78b4948b2359de76aeefeff8bdce0546ad3ccef35b94a

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

548e2875747617f0a16a0100426485a9_JaffaCakes118.exe
Size

158KB
MD5

548e2875747617f0a16a0100426485a9
SHA1

faf20581f853fe12eced09b9303d9ac087e5049f
SHA256

280a8cc97bef4ab031b78b4948b2359de76aeefeff8bdce0546ad3ccef35b94a
SHA512

2aa869e8ccd3bc2c6166ee4e4ad6a0e2f4bd0264d9563fb277a195c6f9c7027efd31b17bfe0affdde2c79428fb72a13c241824f197262ce8158b59067ac80375
SSDEEP

3072:J22ihA0m3BJf0vrBBvtGrcae4BtmjZOa6mv8s57Vb:KA0m3T0vLeDmNXVb

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3520	biclient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	548e2875747617f0a16a0100426485a9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biclient.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3520	biclient.exe
3520	biclient.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 3520	216	548e2875747617f0a16a0100426485a9_JaffaCakes118.exe	85
PID 216 wrote to memory of 3520	216	548e2875747617f0a16a0100426485a9_JaffaCakes118.exe	85
PID 216 wrote to memory of 3520	216	548e2875747617f0a16a0100426485a9_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\548e2875747617f0a16a0100426485a9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\548e2875747617f0a16a0100426485a9_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Local\Temp\biclient.exe
  "C:\Users\Admin\AppData\Local\Temp\biclient.exe" /url bi.bisrv.com /affid "awbronlineweather38005" /id "pdfcreatornuum" /name "PDFCreator" /uniqid 548e2875747617f0a16a0100426485a9_JaffaCakes118 /browser ff
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biclient.exe

Filesize
217KB

MD5
1bdf5e5015efcaa68b05cec0a79be484

SHA1
d22ad1dc1deeb043b4668c5f6b9b59e8b64cbea7

SHA256
f613d98031efc7359c708b9d8a11573526c49e4b60d2614e56747927fa6c2d7b

SHA512
9844b43738b1bae5fb326be8910e9d5a7cf7c6a5838c7ddddb2a04dc72794eff9da87922bc57a228f90ed563e768e56fb5d944a57a452f568272392d0a7d1830

Download Submit
C:\Users\Admin\AppData\Local\Temp\config.ini

Filesize
103B

MD5
108d935a23ec59cc663a470811f339a7

SHA1
5f34b3467430bf0aeea9df29d87c8b0ed527ff56

SHA256
696cbcb59fa7479f33b0204092219be0499527b24d4755cd56c76e0996ca66b1

SHA512
7f64c72a116c1d5dfffed11aacfee80bab3b24590b140134757727a7907695e1e8f498bab43a7fec3fc8a0fda2d74799f4eeb5ba3ec897991dc1c877b2a298f2

Download Submit
memory/216-13-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3520-15-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/3520-73-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download