1979c84f1f7ae2f5d18d618885dda57f6a89ccbcf42e2d1dfa788826c014b946

Analysis

max time kernel
117s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe
Size

92KB
MD5

77e6fb3745c7021781667ae13d4b59bb
SHA1

cf4baa979195d30918c8dfef86679ef9231d6c33
SHA256

1979c84f1f7ae2f5d18d618885dda57f6a89ccbcf42e2d1dfa788826c014b946
SHA512

ef86a0ca136dc4b568fc49aa665ede109cea9bde484402b4009149054e25c924db1596346717b3c799e46456fe19da451eb163b8baf7d2948c4ab23a41b585ae
SSDEEP

1536:0cOJds2+vOxt0c5hfHP1qlmv60lHj4UraTPVPSPkP4PjPAkbohaWdV7lObdEZxHN:aLs9A0c5Olmv60l3LbohaMAuwiNCP7y

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2748	heaxif.exe

Loads dropped DLL 2 IoCs

pid	Process
2152	77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe
2152	77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heaxif.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2152	77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe
2748	heaxif.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2748	2152	77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe	30
PID 2152 wrote to memory of 2748	2152	77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe	30
PID 2152 wrote to memory of 2748	2152	77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe	30
PID 2152 wrote to memory of 2748	2152	77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\77e6fb3745c7021781667ae13d4b59bb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\heaxif.exe
  "C:\Users\Admin\heaxif.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\heaxif.exe

Filesize
92KB

MD5
34ec7439de8f51b875c9109411b3188f

SHA1
040c3e8622960ff97612a7e7b3727eda3bbb0e92

SHA256
557c1cc56d64d57a2701a0ee807c5f3be9b183becfaa65e61af74cab16429607

SHA512
9c674b554cfec2e9b26ea6dabc30780d79f4c69b08676732ab1d9ce6a9e3a64f40454dc0f95b1baf5226d8ae864f19b3f74188aead0912b7af57de989c4093ae

Download Submit