e3593313076e535c8e2ef2ed9ac585e305d638faec47221bf2ab352645e0bc3d

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe
Size

413KB
MD5

891a9b86a23939e3c5dab87dd2da4852
SHA1

909f654457229eb0088b0d148dcf6fec1910df90
SHA256

e3593313076e535c8e2ef2ed9ac585e305d638faec47221bf2ab352645e0bc3d
SHA512

06fb50c0e807e93d065b78d95f4ef63af988c8470c16d91daea475f86bde7cc537b95164109e78c4fa2a1683a320928f255c0b274091615c49e55dafc67d7e72
SSDEEP

12288:EIZIJ8lG4tCZasV15i27y1CzIOSDbckdU+hh/iz09Z2Fg+3e98:HZIJ8lG4tC0sZi270RwTZ2Z2/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1968	Server_Setup.exe

Loads dropped DLL 4 IoCs

pid	Process
1976	891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe
1968	Server_Setup.exe
1968	Server_Setup.exe
1968	Server_Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server_Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1968	1976	891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe	30
PID 1976 wrote to memory of 1968	1976	891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe	30
PID 1976 wrote to memory of 1968	1976	891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe	30
PID 1976 wrote to memory of 1968	1976	891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe	30
PID 1976 wrote to memory of 1968	1976	891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe	30
PID 1976 wrote to memory of 1968	1976	891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe	30
PID 1976 wrote to memory of 1968	1976	891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\Server_Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Server_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Server_Setup.exe

Filesize
720KB

MD5
5aabfd1d1415c8037be6948d23414089

SHA1
5c2ce517b1f27131c5cb7b173dc74f9198ecc68a

SHA256
6e70345aa3e3d6aa6afa0161ab1967058ec477ff9ba12e1d3c072e4d3ddf6df2

SHA512
47de5026d608c7d2e73e76abf58b8c569b611873e2a592a5a47f6fdc874330e706f9bd763b6414a2838e4406d02556852fc7d999557fc8b86eaa30cd2ffb2b85

Download Submit
memory/1968-9-0x0000000000400000-0x00000000004C63E0-memory.dmp

Filesize
792KB

Download
memory/1968-16-0x00000000004D0000-0x0000000000597000-memory.dmp

Filesize
796KB

Download
memory/1968-15-0x0000000000400000-0x00000000004C63E0-memory.dmp

Filesize
792KB

Download
memory/1968-13-0x00000000004D0000-0x0000000000597000-memory.dmp

Filesize
796KB

Download
memory/1968-17-0x00000000004D0000-0x0000000000597000-memory.dmp

Filesize
796KB

Download
memory/1976-0-0x0000000000470000-0x000000000051C000-memory.dmp

Filesize
688KB

Download
memory/1976-5-0x0000000002650000-0x0000000002717000-memory.dmp

Filesize
796KB

Download