ab341d3bbe040919a9bbd349cf782879f4c05ea59f93ba192ec224635ec7404d

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe
Size

680KB
MD5

877a025019b202c2d46aa3a44a2fbec9
SHA1

7d596b16bdd3867bf6910948de7af8e959877dff
SHA256

ab341d3bbe040919a9bbd349cf782879f4c05ea59f93ba192ec224635ec7404d
SHA512

7ed0f61b343fd06c7cdd27eb5e942407b22f434870ddc9e8e612b5053ef102f4ab98e32b1a0a107b937f258be9995c79d804e1058a9c2bbfda5a56b57ce91300
SSDEEP

12288:bGcoXCMUZftSTrISC/icGlCME5D2Ah9TGJrX30GIcEhrDlYXC2YJ2v:1aNQSDFlCzzLTGJ4G+4Y

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe	877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2080	scvhost.exe

Loads dropped DLL 4 IoCs

pid	Process
1344	877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe
1344	877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe
1344	877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe
1344	877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2080	1344	877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe	30
PID 1344 wrote to memory of 2080	1344	877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe	30
PID 1344 wrote to memory of 2080	1344	877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe	30
PID 1344 wrote to memory of 2080	1344	877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\877a025019b202c2d46aa3a44a2fbec9_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe

Filesize
536KB

MD5
af58d6779566f9986770658e9d4f0a4a

SHA1
7a5e379215ec69c1b4dc153c63bcc3dfa7d29882

SHA256
0db6832ca087ea6390ea4a3e9d59ebcd325f15d4aa9f37055e8db0b639765381

SHA512
5e05c2fff37a9d5a173c3ac175892332347b212e450f86cbe776c93122c78e0b3e20bac3fd1c4336f46c25a3f71e61f8d4b1a8b13a7d5225fb697ca12db34995

Download Submit
memory/1344-20-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/2080-21-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2080-23-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-24-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-25-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2080-26-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-27-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-28-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-29-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-30-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-31-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-32-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-33-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-34-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-35-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-36-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2080-37-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download