925794d956eaa96082d597d98259ab5157b1f9ad4073330de516282d361c68a0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87e81ce30b983d2b8add18a202466c6f_JaffaCakes118.exe
Size

56KB
MD5

87e81ce30b983d2b8add18a202466c6f
SHA1

e55d21d287d9f1eff0f9394dab3bc26ff5089436
SHA256

925794d956eaa96082d597d98259ab5157b1f9ad4073330de516282d361c68a0
SHA512

4c5da1f475f9a74211071bb3107f98898fdce1d8138fa9ba65a1551aed601c43fa1f6e65bf723492d39a82d18ec74c7b6650bb770c37054c31ea5eff27c20cc9
SSDEEP

768:uxYVLPmNAjP7ePGONDf7R+LRXrJm2WRKHPGLjP7:mYVHj7e+m/R+LRXcpKH+Lj7

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
544	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87e81ce30b983d2b8add18a202466c6f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2992	87e81ce30b983d2b8add18a202466c6f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 544	2992	87e81ce30b983d2b8add18a202466c6f_JaffaCakes118.exe	30
PID 2992 wrote to memory of 544	2992	87e81ce30b983d2b8add18a202466c6f_JaffaCakes118.exe	30
PID 2992 wrote to memory of 544	2992	87e81ce30b983d2b8add18a202466c6f_JaffaCakes118.exe	30
PID 2992 wrote to memory of 544	2992	87e81ce30b983d2b8add18a202466c6f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\87e81ce30b983d2b8add18a202466c6f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87e81ce30b983d2b8add18a202466c6f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c DelMe0.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DelMe0.bat

Filesize
169B

MD5
3580c1a3ce992ee0b4e7bf085a4d9b1c

SHA1
986c0046afd0910c7c87337c0c9996c12f55a828

SHA256
c236641b732b7d2d665e8c5524c03b930baf24a4c1327173c8a5d4b5f2306fd6

SHA512
1b6ac38c644e844714ce239c0244991ac4177918c0158b86597668cdc6cbd083973a3320bd22e867d56a93a79a7963540c085af0a4c6931dacf15fda43011274

Download Submit