Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 07:12
Static task
static1
Behavioral task
behavioral1
Sample
89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe
-
Size
391KB
-
MD5
89772395aa928df51294bfc6677c40a3
-
SHA1
0ce32f7154e23dd42884fdbad20d806c5ae805f4
-
SHA256
12ea01ce147d3b43d424959fcf23b486642c7449b8646cd00c3cbf52938a7342
-
SHA512
79b36e0dad6fdff3b57b9aa4b469b7df2b9ce8dc3c4d34ae77378f638d7cae85f8ea05731967a36d75f5dcf565f5fb575e4f2fa0a36321eae2fa4e36ba19e716
-
SSDEEP
12288:ue5/Qk/ufkK5UcHYc8Y5cLKLopYW9zOt11S5q:uY/NuDmcHY5Y5CKLoiG+j
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2752 tnhfk.exe -
Loads dropped DLL 2 IoCs
pid Process 2968 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe 2968 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tdt = "\"c:\\windows\\system32\\windowspowershell\\v1.0\\tnhfk.exe\"" 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\windowspowershell\v1.0\tnhfk.exe 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\460abea9.log 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2968 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2968 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe 2752 tnhfk.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2752 2968 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe 32 PID 2968 wrote to memory of 2752 2968 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe 32 PID 2968 wrote to memory of 2752 2968 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe 32 PID 2968 wrote to memory of 2752 2968 89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\windows\SysWOW64\windowspowershell\v1.0\tnhfk.exe"C:\windows\system32\windowspowershell\v1.0\tnhfk.exe" /i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128B
MD52e512a2c0dde18eda81d412661703293
SHA1bc5b4988f3bde0ed5ae15895bb9b8b282005c013
SHA2564def40399db064c5819a25b510d638c719132a55bee260a949cc19f306a988d9
SHA5122485582e04930fec807d8731b3743a81b28f647be13b172ea35aa2fa3e0e1bd0cd14d7bce94d350286059915a5395cf57eb062ac7ef838e9111181ea009bd5e2
-
Filesize
391KB
MD589772395aa928df51294bfc6677c40a3
SHA10ce32f7154e23dd42884fdbad20d806c5ae805f4
SHA25612ea01ce147d3b43d424959fcf23b486642c7449b8646cd00c3cbf52938a7342
SHA51279b36e0dad6fdff3b57b9aa4b469b7df2b9ce8dc3c4d34ae77378f638d7cae85f8ea05731967a36d75f5dcf565f5fb575e4f2fa0a36321eae2fa4e36ba19e716