e9e718ce0a17c8d6f8b3acd616a4935192ce8a6edb80ef93f2104bdbdb38bbf5

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6924d2b279fa65468b6521d8e410e28f_JaffaCakes118.exe
Size

102KB
MD5

6924d2b279fa65468b6521d8e410e28f
SHA1

aa9736f0aa31c24c939610dee4d441136e475bc1
SHA256

e9e718ce0a17c8d6f8b3acd616a4935192ce8a6edb80ef93f2104bdbdb38bbf5
SHA512

fdf304df55ed6c9104c94ca614d477068413b2a3e1a733eeee0e729f05a11f4f828cee981abf949e3644d60557655ff5dc8024fecfeb6bae17aed1349f41b9f6
SSDEEP

3072:YXbe3OJnOG0TjiKyJBjFDTxcP0nVT65YcNQMr/ZJuXruZ:Yy+EjS9TuP0SNQM7ZSyZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2632	mg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mg.exe	6924d2b279fa65468b6521d8e410e28f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6924d2b279fa65468b6521d8e410e28f_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2448	6924d2b279fa65468b6521d8e410e28f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2632	2448	6924d2b279fa65468b6521d8e410e28f_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2632	2448	6924d2b279fa65468b6521d8e410e28f_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2632	2448	6924d2b279fa65468b6521d8e410e28f_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2632	2448	6924d2b279fa65468b6521d8e410e28f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6924d2b279fa65468b6521d8e410e28f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6924d2b279fa65468b6521d8e410e28f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\mg.exe
  "C:\Windows\mg.exe"
  2⤵
  - Executes dropped EXE
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mg.exe

Filesize
88KB

MD5
ac54c4856b7708a313993d0099579edb

SHA1
d1714e7dcb291b7ed1d8a4c7a653aacd4fa91bb4

SHA256
c12fbf6542b6e49074bc705c44c6d41674a3ad0e7a28265d2ad8f458a13d5313

SHA512
14b53fbed2b8b0ea3faaa5532691dbbf4da7a6810c2627ac563635fe7fdf3428ed12206c906beef7d4f21c92019e438e041544b569952e625ca0ec29954c8ff9

Download Submit
memory/2448-1-0x0000000000400000-0x000000000041B200-memory.dmp

Filesize
108KB

Download
memory/2448-9-0x0000000002A30000-0x0000000002A5F000-memory.dmp

Filesize
188KB

Download
memory/2448-8-0x0000000002A30000-0x0000000002A5F000-memory.dmp

Filesize
188KB

Download
memory/2448-11-0x0000000000400000-0x000000000041B200-memory.dmp

Filesize
108KB

Download
memory/2632-10-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download