72e4d40054f89d35b5c05bcaa2b63855a515ae48c77f5b5a16cdbaf535e311f2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a609a015ead31f3d92d259bde4b145f_JaffaCakes118.exe
Size

390KB
MD5

8a609a015ead31f3d92d259bde4b145f
SHA1

7287495cc9d687f7399d38d012131f0f57a8db1e
SHA256

72e4d40054f89d35b5c05bcaa2b63855a515ae48c77f5b5a16cdbaf535e311f2
SHA512

af28d302af55cb1f5a617bfb0c0ccc44345ec8224551f4efdd66d27562011d45278fd9d58e0a56eeb722a74ba6722ede475760037a9d553c1738718a36ad29f5
SSDEEP

6144:mFfW/I0CreVNnsqwXnEXdoaGcLCdC3PTPoKgrPLmloB/WVx9Sl25e+vtUNle:sW/I0CrEhgGSC3PcbLm/9g25RVUbe

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\8a609a015ead31f3d92d259bde4b145f_jaffacakes118.bat	8a609a015ead31f3d92d259bde4b145f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a609a015ead31f3d92d259bde4b145f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1320	2988	8a609a015ead31f3d92d259bde4b145f_JaffaCakes118.exe	30
PID 2988 wrote to memory of 1320	2988	8a609a015ead31f3d92d259bde4b145f_JaffaCakes118.exe	30
PID 2988 wrote to memory of 1320	2988	8a609a015ead31f3d92d259bde4b145f_JaffaCakes118.exe	30
PID 2988 wrote to memory of 1320	2988	8a609a015ead31f3d92d259bde4b145f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\8a609a015ead31f3d92d259bde4b145f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a609a015ead31f3d92d259bde4b145f_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\8a609a015ead31f3d92d259bde4b145f_jaffacakes118.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\8a609a015ead31f3d92d259bde4b145f_jaffacakes118.bat

Filesize
67B

MD5
cc9b6171e9adf4cad58403f60e9d479e

SHA1
c73999ceaa0cc686793f90d9ea9ed698ece3ee35

SHA256
23af33ddd4873a5076ad2e6917f0ba0c71c880f38cb31df5ce73a9f20f055c35

SHA512
8070ab829a6d2b34ea8b8edc67156e7af2c78c795002a63568da2d1255cbc6ca3ba9d70858de639508489fb9f1cdaf066a7f5ef433dbeed5f3ba82e29ec528a1

Download Submit
memory/2988-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2988-8-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download