3c9fc05d4ececbb27916a177541724874bf2717428082d13b9d03c3e8ec4e89d

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fc39120a450d72989a0caa4ba84290f_JaffaCakes118.exe
Size

119KB
MD5

6fc39120a450d72989a0caa4ba84290f
SHA1

c69b646609a1b56984e65f968b9892556b2f1118
SHA256

3c9fc05d4ececbb27916a177541724874bf2717428082d13b9d03c3e8ec4e89d
SHA512

f00d248b892c3eff40f27e43fb6235017371eef39e4aa68618135f112bb225b896dc218dc49fcc29a9c028531a963358e92717a5ed28684ba60cb85c76fe21b1
SSDEEP

1536:CHXs+01N7VzCS7Y0ubDW0SiKShPXdlRt1Rksk9GdBm8YI6/PFDkF0/lB/Ncc:Cp6ppKGDSxR/DBwrPFIFKn/Ncc

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2452	2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\2.exe	6fc39120a450d72989a0caa4ba84290f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fc39120a450d72989a0caa4ba84290f_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1656	6fc39120a450d72989a0caa4ba84290f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2452	1656	6fc39120a450d72989a0caa4ba84290f_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2452	1656	6fc39120a450d72989a0caa4ba84290f_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2452	1656	6fc39120a450d72989a0caa4ba84290f_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2452	1656	6fc39120a450d72989a0caa4ba84290f_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\6fc39120a450d72989a0caa4ba84290f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6fc39120a450d72989a0caa4ba84290f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\2.exe
  "C:\Windows\2.exe"
  2⤵
  - Executes dropped EXE
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\2.exe

Filesize
111KB

MD5
ad1d3c78ad0c31f25e6180db4b15e7ae

SHA1
2234f93db40b8a21057f321aff4ae1af7e96cd5b

SHA256
e7a9b8caec787c651bd42d252f5a02b03e1457339e7be10b68264e6b29d0cc74

SHA512
da80c36bc739b45d44e772a74d832f350e970796573c6244ac441f0a832ebd89936b3f5be1b112b3a6969e5f93d106fcbddb9618c06b257c43b6865e2998789d

Download Submit
memory/1656-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1656-8-0x0000000002790000-0x00000000027DA000-memory.dmp

Filesize
296KB

Download
memory/1656-7-0x0000000002790000-0x00000000027DA000-memory.dmp

Filesize
296KB

Download
memory/1656-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2452-11-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download