c8e010b23b7ab3f5b2ad045f688fb8ca71e9d31a7a14570953487bf3aa4811dc

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe
Size

22KB
MD5

7073938a8e46f5b460c7108bb4d332ba
SHA1

b8aac7cd90a0dd357edeb8a1df7e3b3a85d095b6
SHA256

c8e010b23b7ab3f5b2ad045f688fb8ca71e9d31a7a14570953487bf3aa4811dc
SHA512

89f7265e6d86388e09abe5ec1e4f9efab2f29042e5951d0bd0ecc6b12017fcca6ce86066f123c288081565ae2e7222cab2dddf7f777bac6e37569359c6fe986b
SSDEEP

384:htRDQOeQwzyl5Ut+PltYHPyBLckk/6J34w+o:fRMOgyOu8WE/6J3P

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2068	uamovie.exe

Loads dropped DLL 2 IoCs

pid	Process
1660	7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe
1660	7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\uamovie = "uamovie /u /p {F6515879-1FE9-11D0-BF1E-0000E8D0D146<"	7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\uamovie.exe	7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uamovie.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1660	7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe
2068	uamovie.exe
2068	uamovie.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2068	1660	7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe	31
PID 1660 wrote to memory of 2068	1660	7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe	31
PID 1660 wrote to memory of 2068	1660	7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe	31
PID 1660 wrote to memory of 2068	1660	7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\uamovie.exe
  uamovie 28473924734792328473
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\uamovie.exe

Filesize
13KB

MD5
c99dc4d9f9d97fc294aee1fcff64e337

SHA1
b2cf1230cb6db309eec9683005c5d06b6f627ec7

SHA256
c8c3c77b57b9b058a6c60b57ffd0d7c960da0edf4a948cba05049309cf02fcee

SHA512
bb08ec3ac09e842d7730fb02b37d989b88ead6398377cf5883a9e996329a89f572c43925349ded7a2a56f92f21fd2d30dfe23d56b488594c603025a8099636a9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads