ca2e70225952e6aeb99cf6fb13676d6c7fabaf827f1872a8d550db9e14ce49be

Analysis

max time kernel
94s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2025, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe
Size

33KB
MD5

1ccc4b50a35fffe6d4adc67edcd66ea0
SHA1

ae59b4d3dc097d076a25babf69fd42949be1ea78
SHA256

ca2e70225952e6aeb99cf6fb13676d6c7fabaf827f1872a8d550db9e14ce49be
SHA512

48ba8a1f890ad69d06d7bcabfb44c33e4f03ad90fc4706abb2d6ece26996aa31831fa2cf18c7200ca696542ce0485bc34d925a2f65ce1d7091f58e8e5241b78d
SSDEEP

384:1+a+qRDRFHXU9Kceb4or+EikMRTHV0lTEZEEZeaCfmDsFI3:+qhRJczy+EixTHV0lgZLe/MsFk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4964	~240614671.tmp.exe
4644	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~240614671.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4644	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4964	456	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe	83
PID 456 wrote to memory of 4964	456	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe	83
PID 456 wrote to memory of 4964	456	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe	83
PID 456 wrote to memory of 4644	456	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe	84
PID 456 wrote to memory of 4644	456	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe	84
PID 456 wrote to memory of 4644	456	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe	84
PID 4644 wrote to memory of 3768	4644	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe	86
PID 4644 wrote to memory of 3768	4644	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe	86
PID 4644 wrote to memory of 3768	4644	JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe	86

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3768	attrib.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Temp\~240614671.tmp.exe
  C:\Users\Admin\AppData\Local\Temp\~240614671.tmp.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\~240614671.tmp\JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe
  C:\Users\Admin\AppData\Local\Temp\~240614671.tmp\JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h -r -s C:\ntldr
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~240614671.tmp.exe

Filesize
11KB

MD5
d3b35384632e81a44e22e5ffb97a3da5

SHA1
a59efeb8e38538e475b90326b44fbaae2eab26da

SHA256
d0e28fa3a9cee720fff9f04805ae933d36401a1392c7a2573acca191a886d230

SHA512
3803048343d2f4c84f3e3ea336fb7d07c31e79ce4f177c18f54d43ec65bda02f7808a3f8f3731d519fde8af1b8e0eacb78cb08844c0def58a37e621e83d986f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\~240614671.tmp\JaffaCakes118_1ccc4b50a35fffe6d4adc67edcd66ea0.exe

Filesize
20KB

MD5
4c0b75614f3d7eeae7a87a8ec74deb1b

SHA1
f778f7fba3de49e043fb813da485f7fef5d8f57a

SHA256
86fd3c4f0afeb12d229685df394f16e95817b4cc0141619666c56fea45a5f728

SHA512
40544b7983e713086bab0fc475af6b9d5e73af34d3f87b1142ea768dd05ec469bb2ccc483a964808fae753d162b3acd4d52808826a3e827b3eacd9b15f1a350b

Download Submit
memory/456-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/456-12-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4964-4-0x0000000013140000-0x0000000013149000-memory.dmp

Filesize
36KB

Download
memory/4964-7-0x0000000013140000-0x0000000013149000-memory.dmp

Filesize
36KB

Download