5ab966a9378e5eece159f72f4186776d18724bf8034e7ddaa1a52ca2ff19b55e

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe
Size

15KB
MD5

897ebbd9770cbc693e3ac781037ae099
SHA1

c76b1a4b7a34d0a82e2a481216b71635136906dd
SHA256

5ab966a9378e5eece159f72f4186776d18724bf8034e7ddaa1a52ca2ff19b55e
SHA512

39e9b5331f99a7ae71dbe2ea090b765a22b1f7500770c0fbf337cf96c466c95a76b12f934b49bcebaf7261cceda4e025ebc72bdcb64838f93c40e83ea1e3b0ac
SSDEEP

384:C4vlX4HItWqwijnzcOmr0SRXImm0Q8VKxKoi0:C49OTEnYOmrvF28UJX

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1900	897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\huifitc = "C:\\Windows\\huifitc.exe"	897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\huifitc.dll	897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\huifitc.exe	897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe
File opened for modification	C:\Windows\huifitc.exe	897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1900	897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1900	897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1232	1900	897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe	21
PID 1900 wrote to memory of 1232	1900	897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\897ebbd9770cbc693e3ac781037ae099_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\huifitc.dll

Filesize
36KB

MD5
96e8d481e54da2b46f4669630e9eb69c

SHA1
e3a807ed58290dda7b5e8d216fca1135d09c4062

SHA256
d5c1e62eb57774162b666203d50ae596c6914b669bbdad80c4ec661602808a4d

SHA512
ae5b4ddd94b2b9b34cc1f6faa4b9f7ee30d4ef4ccacc95ede19092b97cc4e069d99eb1854af79aab8ff01024bada0faa96f3ae42d7b738ce9bd91635bb693839

Download Submit
memory/1232-2-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/1900-19-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1900-20-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1900-15-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1900-11-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download