bdb600b2af81d948ceb8b4fdb38a232bb69ca96e347999560501aa6e719854cc

Analysis

max time kernel
6s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82d09383f9ecb27677a7921511710588_JaffaCakes118.exe
Size

708KB
MD5

82d09383f9ecb27677a7921511710588
SHA1

24cb0ee01f258a86cac3702ba4ee58cf12bf87be
SHA256

bdb600b2af81d948ceb8b4fdb38a232bb69ca96e347999560501aa6e719854cc
SHA512

cf10a782ed395ca9468cc334ec11581fdfbbcf181a2f7cc6c98a0182f24c615b68ed355bdb4f8f7bbad80d88549e71f26f2ccf045030847d4b33bb99d44bc6a5
SSDEEP

12288:ppQw9uS22tNcNMNc83GiJuJxaF3Z4mxxPqHre9T5aZ47RfObSuF0:p9vxCQCiQxaQmXCLe9T5a67Rbue

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2060	SERVER~1.EXE

Loads dropped DLL 3 IoCs

pid	Process
2148	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe
2148	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe
2060	SERVER~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVER~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2060	2148	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2060	2148	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2060	2148	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2060	2148	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2060	2148	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2060	2148	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2060	2148	82d09383f9ecb27677a7921511710588_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\82d09383f9ecb27677a7921511710588_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82d09383f9ecb27677a7921511710588_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE

Filesize
344KB

MD5
055f40ea5aa21e5508d0b07983a5e9ba

SHA1
6c37aebba01bfc6ffd0e87aa2dd816f1bf272bbb

SHA256
85fd7478670ffdf8f03521b12a34e5ff5c2b446d067e2921439cf9ba1ef6de71

SHA512
bb41e8b2233ce31d8c1123e3dae0de0401381fde5019cbdf002622d238ab42b9275fb3aa90cc1e381d66fed5e2b4e5fc39cfcb32dd3e707dff9aa265e5b0f00e

Download Submit
memory/2060-15-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2060-23-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2148-0-0x0000000001000000-0x00000000010BE000-memory.dmp

Filesize
760KB

Download
memory/2148-1-0x0000000001069000-0x000000000106A000-memory.dmp

Filesize
4KB

Download
memory/2148-2-0x0000000001000000-0x00000000010BE000-memory.dmp

Filesize
760KB

Download
memory/2148-5-0x0000000001000000-0x00000000010BE000-memory.dmp

Filesize
760KB

Download
memory/2148-6-0x0000000001000000-0x00000000010BE000-memory.dmp

Filesize
760KB

Download
memory/2148-10-0x0000000003820000-0x00000000038E5000-memory.dmp

Filesize
788KB

Download
memory/2148-20-0x0000000001069000-0x000000000106A000-memory.dmp

Filesize
4KB

Download
memory/2148-19-0x0000000000270000-0x000000000032E000-memory.dmp

Filesize
760KB

Download
memory/2148-21-0x0000000003820000-0x00000000038E5000-memory.dmp

Filesize
788KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads