27e2378a2b471c8e8db085b978ceffaf3e2e449e5c15c72a7fa27a9fa9c0c746

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

941b7fcb72745724a050351afc99d725_JaffaCakes118.exe
Size

29KB
MD5

941b7fcb72745724a050351afc99d725
SHA1

b72a4b79fb69e8a547f59d2f9b126282056692ab
SHA256

27e2378a2b471c8e8db085b978ceffaf3e2e449e5c15c72a7fa27a9fa9c0c746
SHA512

4033285fbd3f40692246bdb9da6cdef802d33dc5916297bb72b711d564d0d2a27dbcd4bc4067a6ee1e4182cce84ab4d8a6c7aaac9ba15455806a488a145d7688
SSDEEP

768:KN6Vi83Fj/qiATJ0+5SSqkjzEfZl2xnYdEp2:K8VifJkMjxxQE

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3032	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nskhelper2.sys	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe
2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2772	2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2772	2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2772	2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2772	2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	30
PID 2196 wrote to memory of 3032	2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	31
PID 2196 wrote to memory of 3032	2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	31
PID 2196 wrote to memory of 3032	2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	31
PID 2196 wrote to memory of 3032	2196	941b7fcb72745724a050351afc99d725_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\941b7fcb72745724a050351afc99d725_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\941b7fcb72745724a050351afc99d725_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\259478537.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259478537.bat

Filesize
269B

MD5
306fd5009eb3f800f69d9d7de1c755b7

SHA1
5b5c76d0273033c7d18344423cfcc7f4e7c57670

SHA256
0e31d5c8deb771466af6b710ad2a9cc58f18c85959033482ed77b60c2e388bc8

SHA512
4bf3fc85df7b1c2b969769697a50f691582b5213252ed856eec54c6942d55bea7711005cc4db4be53336304edde2ed8caa92d7314a5f11f8b52232ecf4d14b43

Download Submit
\Users\Admin\AppData\Local\Temp\dll495.dll

Filesize
49KB

MD5
90efb0d7e60224e65a220e820ad87e50

SHA1
2d2c91de7d598ca3f970e02f62beaeb3f7069af5

SHA256
e5de4edf2afffafbc9e1a3ac32f5f159e9583ba08bc645bd55eece1f6df388a0

SHA512
ee12303ab112c1d079633004c86cdd1c0a1a0aebcce4081c79a185bb1569f6169933e37f858dcecbd05e6155a18d5d776d0c675e5b52a5b01b4cdcc696a6435b

Download Submit
memory/2196-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download