b23095034879d2a3915ccda4ff8e8987dd931790996b00d35d90326c79296952

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d07f968a3ac3426cbedeb06d045b1f_JaffaCakes118.exe
Size

191KB
MD5

68d07f968a3ac3426cbedeb06d045b1f
SHA1

8d6e2c388ded0c4eb0b72fe0e3d04f62d4f27280
SHA256

b23095034879d2a3915ccda4ff8e8987dd931790996b00d35d90326c79296952
SHA512

7046983f50e9e8d85363143e8092dd00fd78d643a9d43d507d192c0998a126eac60660e517dbc73d2f84307118b288fcb7704a0d827cf223a79f33d6c5bb2bc4
SSDEEP

3072:Ii8o8NB0DvR6L/A5OUO/ass3fifp+LNrQoIG+:Z8UFyC/H3fih+BczZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2920	CryptedFile.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptedFile.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2920	CryptedFile.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2920	2116	68d07f968a3ac3426cbedeb06d045b1f_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2920	2116	68d07f968a3ac3426cbedeb06d045b1f_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2920	2116	68d07f968a3ac3426cbedeb06d045b1f_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2920	2116	68d07f968a3ac3426cbedeb06d045b1f_JaffaCakes118.exe	30
PID 2920 wrote to memory of 1212	2920	CryptedFile.exe	21
PID 2920 wrote to memory of 1212	2920	CryptedFile.exe	21
PID 2920 wrote to memory of 1212	2920	CryptedFile.exe	21
PID 2920 wrote to memory of 1212	2920	CryptedFile.exe	21
PID 2920 wrote to memory of 1212	2920	CryptedFile.exe	21
PID 2920 wrote to memory of 1212	2920	CryptedFile.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\68d07f968a3ac3426cbedeb06d045b1f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\68d07f968a3ac3426cbedeb06d045b1f_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe
    "C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe

Filesize
63KB

MD5
e27c82866a2bfe54acd61ee759785b8b

SHA1
d853b076197f79c4c80f4a4926bf0182b0ecc6ac

SHA256
58ae903a5b9f91b963f8d17bae96e47b05eabed0374a44d28a56faf0c29d4187

SHA512
ebc125776e142cb7d7bfa6e8f172ad052f441fb72311e4783c86bb0548262500c3495f4313494e81a4c47d32c0b73500f367b80125869c5aa4cb75e9744bafbc

Download Submit
memory/1212-13-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1212-22-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2116-0-0x000007FEF571E000-0x000007FEF571F000-memory.dmp

Filesize
4KB

Download
memory/2116-1-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2116-2-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2116-4-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2116-18-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2920-17-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2920-16-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download