7a7380808dbf418b9e968a351ded5dc531fd472ac8e40b8678608e356a396fb0

Analysis

max time kernel
139s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

549d63d0b6e47a41168c6c8ab93cb1db_JaffaCakes118.exe
Size

247KB
MD5

549d63d0b6e47a41168c6c8ab93cb1db
SHA1

0b14abd537317d9ae1d431c5342c1e33ecf8a3d8
SHA256

7a7380808dbf418b9e968a351ded5dc531fd472ac8e40b8678608e356a396fb0
SHA512

3dc0183dfd3ab32df83be535d10214bfac8360f90449fb1b0bdffedfadd6b5ae8832b0e7b5018d511938fb707cac83e138bd57a7e452a125a7d5fb99f8e51322
SSDEEP

6144:UWwMnudUSz4wgz+1/IFUOk4V0Mi3fdbENPwhXSF1Ak:5upXgyyFUhuniSpcs1Ak

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4668	Au_.exe

Loads dropped DLL 4 IoCs

pid	Process
4668	Au_.exe
4668	Au_.exe
4668	Au_.exe
4668	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	549d63d0b6e47a41168c6c8ab93cb1db_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023cc5-4.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 4668	2712	549d63d0b6e47a41168c6c8ab93cb1db_JaffaCakes118.exe	84
PID 2712 wrote to memory of 4668	2712	549d63d0b6e47a41168c6c8ab93cb1db_JaffaCakes118.exe	84
PID 2712 wrote to memory of 4668	2712	549d63d0b6e47a41168c6c8ab93cb1db_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\549d63d0b6e47a41168c6c8ab93cb1db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\549d63d0b6e47a41168c6c8ab93cb1db_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\getmacaddress.dll

Filesize
184KB

MD5
e195b642ce13ecd2cb0e66f71de0ddbb

SHA1
4b937bd5fe3a053bc70d85896b3cfe5fc61f1b79

SHA256
030e863fe9bac5ddedc3a7f438d88c4070d1e7824a5f42522e34e42f97cc471e

SHA512
61a552b6dac376c67a159ed3271fcf0f67de0351adab4a638f03d71b57b145916888aa3165fa6afc476ebe4bfddc9c7a3c5d91ea334d36acea1d0bee03841ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssB354.tmp\System.dll

Filesize
10KB

MD5
4eff5fafd746f5decb93a44e3a3d570c

SHA1
a11aa7681b7e2df1c7f7492a127d332d1495ea8a

SHA256
cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

SHA512
cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
247KB

MD5
549d63d0b6e47a41168c6c8ab93cb1db

SHA1
0b14abd537317d9ae1d431c5342c1e33ecf8a3d8

SHA256
7a7380808dbf418b9e968a351ded5dc531fd472ac8e40b8678608e356a396fb0

SHA512
3dc0183dfd3ab32df83be535d10214bfac8360f90449fb1b0bdffedfadd6b5ae8832b0e7b5018d511938fb707cac83e138bd57a7e452a125a7d5fb99f8e51322

Download Submit
memory/4668-22-0x0000000003240000-0x000000000326F000-memory.dmp

Filesize
188KB

Download