c734651a6b47fc930b4bf622311a44f70a30046591097f8ad8e5415f1d3e454e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe
Size

386KB
MD5

6ab2e0786f17d316bf7c419c5cf2dea9
SHA1

b9771c7b209c2bdce022736d3fade967fa2261ec
SHA256

c734651a6b47fc930b4bf622311a44f70a30046591097f8ad8e5415f1d3e454e
SHA512

5db35d5384c92925f12abbc9673e2c66445e81ec0052f36be2fae8031d05106da40c6ce7aeb43fc45de83b25648b63050ed56786d2ded4015b2630c27e5a8a20
SSDEEP

6144:vFdmk8Mjrj9IczXTBevutMPLWq6TqdojY5QVYJidhfVwBEvUulB6O:vFdmBMjP9JXTAvu+izLY5XIV0U1lB5

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2080	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2204	012569.exe

Loads dropped DLL 2 IoCs

pid	Process
2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe
2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\012569.exe	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tmp.bat	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\012569.exe	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	012569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe
2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe
2204	012569.exe
2204	012569.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2204	2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2204	2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2204	2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2204	2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2080	2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe	31
PID 2408 wrote to memory of 2080	2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe	31
PID 2408 wrote to memory of 2080	2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe	31
PID 2408 wrote to memory of 2080	2408	6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6ab2e0786f17d316bf7c419c5cf2dea9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\012569.exe
  C:\Windows\System32\012569.exe 1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\tmp.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\tmp.bat

Filesize
267B

MD5
6c87d8d1b55b81e3f32aea1bad6c60f3

SHA1
325246d4c44277acb68b9a0d39706e1d33f06c1e

SHA256
82cd4e611e35757753d4b7a7c30e1c3e6171bd990bd725ece8f199e6ee195610

SHA512
003da37c534dd39d93a8f84436f52bfa4b657aafad201194f81f5b1ef56a4a0544082300a5ba4ea2673d5d6690816288d9292e3d8008c8fd3353c2e8001f497e

Download Submit
\Windows\SysWOW64\012569.exe

Filesize
386KB

MD5
6ab2e0786f17d316bf7c419c5cf2dea9

SHA1
b9771c7b209c2bdce022736d3fade967fa2261ec

SHA256
c734651a6b47fc930b4bf622311a44f70a30046591097f8ad8e5415f1d3e454e

SHA512
5db35d5384c92925f12abbc9673e2c66445e81ec0052f36be2fae8031d05106da40c6ce7aeb43fc45de83b25648b63050ed56786d2ded4015b2630c27e5a8a20

Download Submit