30ae3b90f616162834949a6d79416712d01df3e058764f8e01f0a17d8fb5e3d0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe
Size

162KB
MD5

8696e62c87144711215440191b8bbfc1
SHA1

7d56c474a8c4a5088517d1fc976a54c1c3f5ca7b
SHA256

30ae3b90f616162834949a6d79416712d01df3e058764f8e01f0a17d8fb5e3d0
SHA512

c2cc35bf1683584aa5858f7a37349bf9142afa9ee6ec3a48b19aea6834deba5d8d3b255e786244cfc1efbb5122e836d66252b3ce29bd3d5046afa09d60f31e55
SSDEEP

1536:0vn9DmOPj3/EyIR1Y+IjIVZgFNyifN/E3+gHurSwzMpE1gNYlVLNl:0l3TIR1YzNy8E3+dGna1rLNl

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2564	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2564	2888	8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe	30
PID 2888 wrote to memory of 2564	2888	8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe	30
PID 2888 wrote to memory of 2564	2888	8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe	30
PID 2888 wrote to memory of 2564	2888	8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe	30
PID 2888 wrote to memory of 2564	2888	8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe	30
PID 2888 wrote to memory of 2564	2888	8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe	30
PID 2888 wrote to memory of 2564	2888	8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8696e62c87144711215440191b8bbfc1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Jtp..bat" > nul 2> nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Jtp..bat

Filesize
238B

MD5
a2811de1749d18dd8c348eff8369ef89

SHA1
d7bddd24b84d13a7b0b40bf473f55d8976b10454

SHA256
bcd7000cc53f4afcc1b564b70832ae90770ae3773c3a2dcc3ea1ab5a4c5aa324

SHA512
09088a978a81b549d0eec9d7987d1ed1ba08864ef7615b206bf37fb8ac3311e0518aa62c494cd09a537b5a6082c976e0a600f15ec3a4552525a4798ba4f60d9a

Download Submit
memory/2888-0-0x0000000000320000-0x0000000000332000-memory.dmp

Filesize
72KB

Download
memory/2888-1-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2888-4-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download