9b7df8c53ef72aa5e819b3caf7e650000e91ddc6056b5c98b3f1f2dd79595d98

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe
Size

20KB
MD5

74949fc5764d1ac8979588746f0f9272
SHA1

8c09c3b3ac825389f3043f8b56bd9d7079c68bbf
SHA256

9b7df8c53ef72aa5e819b3caf7e650000e91ddc6056b5c98b3f1f2dd79595d98
SHA512

d8fcbda563c10cec4c430a0dcd1bfb5371d9a9a7e58a2f71b0a414ea57f21a8e7c0426c989ac68cf6581b388583b925283b807869396aa9dd3bbee7ec2380d03
SSDEEP

192:fGAegjMFcu0PfkBxBrU+Dpl0WpB04+WAdo:fLrMMMUmrehWAdo

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2084	74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe
2084	74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe
2084	74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1748	2084	74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe	31
PID 2084 wrote to memory of 1748	2084	74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe	31
PID 2084 wrote to memory of 1748	2084	74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe	31
PID 2084 wrote to memory of 1748	2084	74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\74949fc5764d1ac8979588746f0f9272_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
329B

MD5
4de0d32d6a04b032d102b9f6992dfe94

SHA1
e46ecc12820316be88d78ff3e896242e4b6b88ce

SHA256
7356d9ac46a248229d0d7b24fda0170350750a6eb7a6843dd4ed03eeba6625ac

SHA512
401f081285ce300eaac40c117a2ed7cc9fdc4bb7ac96e22d21d552366e4f8b9137fa390379b8e6a46b3262722e7d1727635a90af326eb815ce19c28360d326b2

Download Submit
memory/2084-9-0x0000000004FF0000-0x0000000005337000-memory.dmp

Filesize
3.3MB

Download