22107e51ff3f343da11ec7e9b4425079c5a8855550f89f62cd312e1eb545e1a1

Analysis

max time kernel
11s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe
Size

131KB
MD5

888e3a2274b8e3b956135de210a5d19b
SHA1

9982ce2c4c5e2c9b391cf04dc3230a8e07c3b4e5
SHA256

22107e51ff3f343da11ec7e9b4425079c5a8855550f89f62cd312e1eb545e1a1
SHA512

55a2ce085c5a50b0b3e5b5818a511c5fe14354414f0703f0f96ba89478dd7f6e064b3abc2be2694e80dd3b4e25bd140ee5cbaa67220c7c80ccb59b1264c54d14
SSDEEP

3072:dbZXFYtIRhkYy2iGA1/5LDngbYq7lPW9H1h4sWFq:7XZyYNiz/54bFliHTh+q

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1300	sxeA94C.tmp

Loads dropped DLL 2 IoCs

pid	Process
1612	888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe
1612	888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sxeA94C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1300	1612	888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe	30
PID 1612 wrote to memory of 1300	1612	888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe	30
PID 1612 wrote to memory of 1300	1612	888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe	30
PID 1612 wrote to memory of 1300	1612	888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe	30
PID 1612 wrote to memory of 1300	1612	888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe	30
PID 1612 wrote to memory of 1300	1612	888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe	30
PID 1612 wrote to memory of 1300	1612	888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\888e3a2274b8e3b956135de210a5d19b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\sxeA94C.tmp
  "C:\Users\Admin\AppData\Local\Temp\sxeA94C.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\sxeA94A.tmp

Filesize
15KB

MD5
bd815b61f9948f93aface4033fbb4423

SHA1
b5391484009b39053fc8b1bba63d444969bafcfa

SHA256
b018bf9e9f8b6d945e6a2a25984970634884afabc580af2b4e855730520d5d76

SHA512
a363abe97b5a44e5d36af859e8d484daffe1d8e321c87969a75d1bfaa4288a5e6be1922a02c6d72937c84e81a79a1c7f6c9f2a44a995cac3f993ed5608afcd71

Download Submit
\Users\Admin\AppData\Local\Temp\sxeA94C.tmp

Filesize
384KB

MD5
c9b2a254cc62a1bb132389e997055a50

SHA1
fbed8815900f88446b8c9fa018f6d397c2aaa4b1

SHA256
ff6361356afa66b1c6f14b539fe6cfef65ed48ad7919e4f5fbf1ea88a238feeb

SHA512
2bd3d1aa0d88f7c36e02052a97a862cf25ac8bf94189208c1bdf36a6716f96e935f05db633b854a290f8b4a6d23aa2c1b807ee6635b4088e5ab9ed73c877deb6

Download Submit