15ef91717ec79c73a69353ec4d58950ce9349d2e8a4b8895ee4c462c8f7ef303

Analysis

max time kernel
150s
max time network
111s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe
Size

134KB
MD5

8c79e404ab329917ae6a0b1cfd4a9c7e
SHA1

4c3fb19be315322bf60da1a4c2f1bb955120a80f
SHA256

15ef91717ec79c73a69353ec4d58950ce9349d2e8a4b8895ee4c462c8f7ef303
SHA512

64735178b0ac4f24ef9fce6cbbc53e25ffe1fdebf16f5b5054c99041c7fab106eb74c6839bbccd107c4c2f3e831c5c1321b54199ea6c2c126e23537335a906db
SSDEEP

3072:S9Zu7RZHR4++Tz3saVFJjO6cbsCuCsywO/FzdXr:S9ZuHG/zjO6HWo+X

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2128	Clynya.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe
File created	C:\Windows\Clynya.exe	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe
File opened for modification	C:\Windows\Clynya.exe	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe
File created	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	Clynya.exe
File opened for modification	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	Clynya.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clynya.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	Clynya.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International	Clynya.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe
2128	Clynya.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2128	2916	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2128	2916	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2128	2916	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2128	2916	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2128	2916	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2128	2916	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2128	2916	8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8c79e404ab329917ae6a0b1cfd4a9c7e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\Clynya.exe
  C:\Windows\Clynya.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Clynya.exe

Filesize
134KB

MD5
8c79e404ab329917ae6a0b1cfd4a9c7e

SHA1
4c3fb19be315322bf60da1a4c2f1bb955120a80f

SHA256
15ef91717ec79c73a69353ec4d58950ce9349d2e8a4b8895ee4c462c8f7ef303

SHA512
64735178b0ac4f24ef9fce6cbbc53e25ffe1fdebf16f5b5054c99041c7fab106eb74c6839bbccd107c4c2f3e831c5c1321b54199ea6c2c126e23537335a906db

Download Submit
C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job

Filesize
372B

MD5
90ca1aeb723dc874365c350c68b70461

SHA1
6cc52a7a5e4208b020aefb2ed50e28099c50ee8a

SHA256
12d19bc132f956bca61eec57cad8337115530c3e5521d3593678eaac05cae1d1

SHA512
331ac5673ff21bb262966312d1d6009c4fcf8754159c3214eb288ff0d297c20c2024ddcd09ab0b93996f15b52aa5dbb58e518d29a3b702d28052c667c2b73f82

Download Submit
memory/2128-47728-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2128-9-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2128-8-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2128-47726-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2128-47727-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2128-47729-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2128-47730-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2128-47732-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2128-47733-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2128-47737-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2916-0-0x00000000002A0000-0x00000000002CA000-memory.dmp

Filesize
168KB

Download
memory/2916-47725-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2916-1-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download