Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe
-
Size
135KB
-
MD5
6959ade1f8a55899234fd592bdc7ce69
-
SHA1
08adccf0d635446dc38b58b9677783c7883411a0
-
SHA256
7401a88eb93ccf97185248fcf43ef1ba3d91d5f8e226a389d95fdb20750f5198
-
SHA512
24c0995b803cb97a44f31435f7aae59f7d67ae208bef1a49e480741bb5c3d530fe0174bc6ad8df8ab93b75f418fa4349c01d4ac92a9693ae5a114aca66f1e249
-
SSDEEP
3072:nnb65ptbwDx4/RdgCQKY8UxdptcJ/xpOv:nnbvDe/vfQKadwJpp6
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1272 netprotocol.exe 2452 netprotocol.exe -
Loads dropped DLL 3 IoCs
pid Process 2168 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 2168 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 1272 netprotocol.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe" 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2336 set thread context of 2168 2336 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 31 PID 1272 set thread context of 2452 1272 netprotocol.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netprotocol.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2168 2336 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 31 PID 2336 wrote to memory of 2168 2336 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 31 PID 2336 wrote to memory of 2168 2336 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 31 PID 2336 wrote to memory of 2168 2336 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 31 PID 2336 wrote to memory of 2168 2336 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 31 PID 2336 wrote to memory of 2168 2336 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 31 PID 2168 wrote to memory of 1272 2168 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 32 PID 2168 wrote to memory of 1272 2168 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 32 PID 2168 wrote to memory of 1272 2168 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 32 PID 2168 wrote to memory of 1272 2168 6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe 32 PID 1272 wrote to memory of 2452 1272 netprotocol.exe 33 PID 1272 wrote to memory of 2452 1272 netprotocol.exe 33 PID 1272 wrote to memory of 2452 1272 netprotocol.exe 33 PID 1272 wrote to memory of 2452 1272 netprotocol.exe 33 PID 1272 wrote to memory of 2452 1272 netprotocol.exe 33 PID 1272 wrote to memory of 2452 1272 netprotocol.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\6959ade1f8a55899234fd592bdc7ce69_JaffaCakes118.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Roaming\netprotocol.exeC:\Users\Admin\AppData\Roaming\netprotocol.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Roaming\netprotocol.exeC:\Users\Admin\AppData\Roaming\netprotocol.exe4⤵
- Executes dropped EXE
PID:2452
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD55b74af80c98916b3b0966a1a2306568d
SHA1a5e50d3ad945eb556160ed279cadba46a49fb8a9
SHA2562f4c4670d31e9c6adc5b8c6f90e38e2501ea7d2eff4196e6d7b1f484d936f0d9
SHA512207de5fea9ef019b77155c7c44ce52253350b5960d6276fa39d6c28938f3114308ea05bb2c73663aed810dae857666b83ccf3641284ad6991665a3bd62da8719