09e9d01738fe9fbcf7fbc165aba42f72a2766f83ee24fae0d2d368a8f7a72e0b

Analysis

max time kernel
150s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe
Size

3.8MB
MD5

75db01c8c2c40b75d70a290f4c086aa9
SHA1

8c2f91b9e7565ae84841e6d0d684928901674fba
SHA256

09e9d01738fe9fbcf7fbc165aba42f72a2766f83ee24fae0d2d368a8f7a72e0b
SHA512

feade716992458e9bdf628298bd91ea4c273c14a2af7e7b1157d10b7a61077ec33f5eb5934ee944798cfdad62107fd68708e2fcb9354f979824e984f156c0ce3
SSDEEP

98304:mgtaf3lv94EdV5xujnTTeElreGy9G927MG0yYwna9r+tNxttaU:efZdV5xujOElX92YG0fwny6Lj

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp
2932	rkverify.exe

Loads dropped DLL 7 IoCs

pid	Process
2408	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe
2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp
2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp
2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp
2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp
2932	rkverify.exe
2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rkverify.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe
2932	rkverify.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2184	2408	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2184	2408	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2184	2408	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2184	2408	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2184	2408	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2184	2408	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2184	2408	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2932	2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp	32
PID 2184 wrote to memory of 2932	2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp	32
PID 2184 wrote to memory of 2932	2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp	32
PID 2184 wrote to memory of 2932	2184	75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp	32

C:\Users\Admin\AppData\Local\Temp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\is-62JMC.tmp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-62JMC.tmp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp" /SL5="$50150,3625123,54272,C:\Users\Admin\AppData\Local\Temp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\is-OJMR2.tmp\rkverify.exe
    "C:\Users\Admin\AppData\Local\Temp\is-OJMR2.tmp\rkverify.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\CSME2E0.tmp

Filesize
160KB

MD5
5ac09190daf249c3e93c3ac961067024

SHA1
bad9c0d552d54310f669d66b549dcada90583812

SHA256
f4934185f75518a13ef5425959f47516cc8467f513e838a82e749ffb782d7e23

SHA512
2a87686c038e8a34f8e04a844726de564a08baeedc87632219b86f455d5222efe2ed7557fad9658627e304d916a75cfcb3c9dede4e72057a070f64370aa52f39

Download Submit
\Users\Admin\AppData\Local\Temp\is-62JMC.tmp\75db01c8c2c40b75d70a290f4c086aa9_JaffaCakes118.tmp

Filesize
677KB

MD5
c04af2e8479e97b7734a912456464ca8

SHA1
abc4a5744c5a48bde3644ed92fc8a685d56cd60b

SHA256
9e18f7e9753f2951bf13f8cd2e972202af5d87b21b54a5e2b2bc53e1285ead48

SHA512
6b820ecb369e0b86acdade06d17552b2c9aa953bc3b65dff52eb4388393bbe5b36eaa9518f86d3f25ea2758fe3b03b184a74f2585268d6063c2ff8a4e72a132c

Download Submit
\Users\Admin\AppData\Local\Temp\is-OJMR2.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-OJMR2.tmp\rkverify.exe

Filesize
268KB

MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
memory/2184-8-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2184-33-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2408-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2408-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2408-34-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download