b88166397cc6f708c40de2c03575e69a202dcb1b60861faee3647e23a9e21ae6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81c5d2fb64fcf130653684d131eeb359_JaffaCakes118.exe
Size

10KB
MD5

81c5d2fb64fcf130653684d131eeb359
SHA1

905b40b07e2ffc71cadbc996257820ef34c009f9
SHA256

b88166397cc6f708c40de2c03575e69a202dcb1b60861faee3647e23a9e21ae6
SHA512

5ed942dda7aaa674ced95947ebe6977d650d16052ee2b28afc42554965b2a0b416c58faf02fd3f1cba27bbdf6188ec133e95ebb7aa738e324bcc3408d64576e7
SSDEEP

192:n9lgTtuvm5i9LPxqW8A/pQLoPGJXrX7QeuZw6:vgT0n8AioPq/TN6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2520	tachfir.exe

Loads dropped DLL 2 IoCs

pid	Process
2384	81c5d2fb64fcf130653684d131eeb359_JaffaCakes118.exe
2384	81c5d2fb64fcf130653684d131eeb359_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81c5d2fb64fcf130653684d131eeb359_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	DllHost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2520	2384	81c5d2fb64fcf130653684d131eeb359_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2520	2384	81c5d2fb64fcf130653684d131eeb359_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2520	2384	81c5d2fb64fcf130653684d131eeb359_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2520	2384	81c5d2fb64fcf130653684d131eeb359_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\81c5d2fb64fcf130653684d131eeb359_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81c5d2fb64fcf130653684d131eeb359_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\tachfir.exe
  "C:\Users\Admin\AppData\Local\Temp\tachfir.exe"
  2⤵
  - Executes dropped EXE
  PID:2520

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\back.jpg

Filesize
571B

MD5
62d72cf14cd8c828f82ddffc03a6daba

SHA1
4353464b58a4eb9621922bc1f117a5366bde9879

SHA256
c686f37982eeed40293067834256781a08a165dd7582e68cf48f7c65ca864252

SHA512
57217f68604902bfc96d0c2116ce09a86a9abfbf3c94561936811ab63b1162d3d3b481d70457b2ee8e803790e06e3235a369b2ce74023b5da645db96665039d7

Download Submit
\Users\Admin\AppData\Local\Temp\tachfir.exe

Filesize
7KB

MD5
4e6d09b377a02af760466011d9e4451d

SHA1
9f79cb1ed566c88e60ed00f234f35eb5c419683a

SHA256
23aa98695eabd99a18dd5836ee88ce5b4dde5220224aed42dc734e09ca4d57ff

SHA512
b599084cbfb5d5c9076580170a0364b005357986bda8c3a74168a5d26d5cf403e74a33d006bf57b0991a9458085ccdb4f7fa3d2f38f74393ce851e7bd5cf6c89

Download Submit
memory/2384-11-0x0000000002950000-0x0000000002952000-memory.dmp

Filesize
8KB

Download
memory/2708-12-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2708-13-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2708-15-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download