Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 13:55
Behavioral task
behavioral1
Sample
6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
6fdac130ff4e2d72d96938dd1af69f8c
-
SHA1
3e8cadf93b2b95e86c2c8d9682a396d586c1f1b9
-
SHA256
0f0b8579bd6d93b8323e2233ad14a189d33e9b1cddc80e973d71be7149166870
-
SHA512
05b0a95f8d8816805e47e2ea3337f46137803cadd4610d48c013de34b5c2637af84523ff2709269911c56a8c0365ec372050dc70c61245c111033590d8defb2e
-
SSDEEP
12288:h89pCy3yYrs0ELn/rdbLUIKfMWpk7sTjpkMgyP23xoNjDk6zfvP/XQL1F4apOUO+:h8/Fs0QTdbQIK6sTjp4C2B7kXI34apz/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1808 explorer.exe -
Loads dropped DLL 2 IoCs
pid Process 2500 6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe 2500 6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2500-0-0x0000000000400000-0x000000000054A000-memory.dmp upx behavioral1/files/0x00080000000120f4-5.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2500 6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe 2500 6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1808 2500 6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe 30 PID 2500 wrote to memory of 1808 2500 6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe 30 PID 2500 wrote to memory of 1808 2500 6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe 30 PID 2500 wrote to memory of 1808 2500 6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe 30 PID 1808 wrote to memory of 2924 1808 explorer.exe 32 PID 1808 wrote to memory of 2924 1808 explorer.exe 32 PID 1808 wrote to memory of 2924 1808 explorer.exe 32 PID 1808 wrote to memory of 2924 1808 explorer.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fdac130ff4e2d72d96938dd1af69f8c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe" --ch=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\30749.bat"3⤵
- System Location Discovery: System Language Discovery
PID:2924
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD5fe146d83852f8934d457184fcc1dcc4d
SHA1940d90be93e7e264c936ce7c8ecaaab46b002671
SHA25672eccf0c74695d2b8365947ae409abd2290258067f287e0235bfe5883ea99472
SHA51222a7dd695dd4c8de7def983f7703b69406186e3ce0a9e2ef36dc1fab03176a51cde07cfe4f5f307163173eb230b8bf9979dd41f59b6e69c1d0053a72b0d79000
-
Filesize
1.7MB
MD56fdac130ff4e2d72d96938dd1af69f8c
SHA13e8cadf93b2b95e86c2c8d9682a396d586c1f1b9
SHA2560f0b8579bd6d93b8323e2233ad14a189d33e9b1cddc80e973d71be7149166870
SHA51205b0a95f8d8816805e47e2ea3337f46137803cadd4610d48c013de34b5c2637af84523ff2709269911c56a8c0365ec372050dc70c61245c111033590d8defb2e