5ae9977789600dca4d9cab2fd98fcfba0f9b2fee137bf27d7695120e20d6e52f

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe
Size

18KB
MD5

87c565a8fb807a4078517f1307b314de
SHA1

ce84d1d7e9359dce786ad6277581fee1606d786a
SHA256

5ae9977789600dca4d9cab2fd98fcfba0f9b2fee137bf27d7695120e20d6e52f
SHA512

a5e17542cc7d6f7eeef333f1a6e7a99224c833efd0b3441e8f4fb97d53a470c3abcd509c8ba11af4ffd7afa629d32924eeba08d1c9604e0f72ccdf076ad45c60
SSDEEP

384:S1JcG+C9fh9nuYRQLUONnUYeGANo8O1cZ22qvtHWaaVatexuACtZsFm:S7kC9eCCf1i22qvQapJA6sc

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dsound.dll.dat	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dsound.dll.dat	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\mfcE032.log	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe
File opened for modification	C:\Windows\system\mfcE032.log	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2796	2548	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2548	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe
2548	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe
2548	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2796	2548	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe	29
PID 2548 wrote to memory of 2796	2548	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe	29
PID 2548 wrote to memory of 2796	2548	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe	29
PID 2548 wrote to memory of 2796	2548	87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87c565a8fb807a4078517f1307b314de_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 204
  2⤵
  - Program crash
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\mfcE032.log

Filesize
22KB

MD5
134c61b85d5cf257d361f59736bbe3c9

SHA1
33ef567c764c5b89734847020a74507d2de21b17

SHA256
0eda7cd10888f5e8ae86c434081ee8ad38af571a90e056d51ba88e761d4ba6d0

SHA512
17446cb6cffee99319e725b1309b5db2bbed2e94cb7bd6ad543508c85a48dff9be683249df648dcac5a386eb97faba6096386183b0b71be6cd22c85138bf91e2

Download Submit