c8b25d1620e03b3c433f2f8b07f53b398c7c7183efad7b869f917b4bb49976ca

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe
Size

88KB
MD5

94870f8f51f8ba88a9b742d1d1e137c5
SHA1

cd9121a6305255bfb0b47dfe12a5e0b00b335a92
SHA256

c8b25d1620e03b3c433f2f8b07f53b398c7c7183efad7b869f917b4bb49976ca
SHA512

a02ad3a5484d85e31359acd40151584b4b661217997d6e932c320da88d747b46c84db3c0d32bd9de54e029aecebe880838b5fb993c95a9e2f68425c6363f3399
SSDEEP

1536:/U2fHKylNO6Cblg7yQX/HS5swL+UR71wipFBFKH9LPgCGF/W31kBoFHn:82P3O0K5fjl1wyFBFSLPg+Me

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2708	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2448	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2708	2448	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe	31
PID 2448 wrote to memory of 2708	2448	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe	31
PID 2448 wrote to memory of 2708	2448	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe	31
PID 2448 wrote to memory of 2708	2448	94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe	31
PID 2708 wrote to memory of 2628	2708	cmd.exe	33
PID 2708 wrote to memory of 2628	2708	cmd.exe	33
PID 2708 wrote to memory of 2628	2708	cmd.exe	33
PID 2708 wrote to memory of 2628	2708	cmd.exe	33

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2628	attrib.exe

C:\Users\Admin\AppData\Local\Temp\94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c qgltxmid.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\attrib.exe
    attrib -r -s -h "94870f8f51f8ba88a9b742d1d1e137c5_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qgltxmid.bat

Filesize
238B

MD5
b301470d0350867c201175490f07a1da

SHA1
3be42bb608be591111dc44d78b6222cd7585b5c8

SHA256
c97b468269561943b2adbbdb382c0367b60beb7b04449cbb7d99f44ef7988fcc

SHA512
40ec500a1c29818b500a4f0cdfc318d433967720b5e671fca2ec2eae904a7bb9ee5cf029241553adf7e26df3e69a221e9b6f651981ccc154e46efe67ad291af1

Download Submit
\Users\Admin\AppData\Local\Temp\qzeqrbhf.dll

Filesize
42KB

MD5
64abd1881f5bc0972d49787e6ca75ea0

SHA1
0bdcb49f6f130a6053014b93f88d1f2cf84c4466

SHA256
692cd2ca18c800a5a9069cbe3bb630a1d53610897b60d4e4acf75ef559d8ce79

SHA512
fba3e9d87be31123d10ad43ca43e2800a3a6a33e692833976b98df9928ab3b43b400d127fd185c7ae812243930a2932140dffa649d2093948799e7d1f2c4374f

Download Submit
memory/2448-4-0x0000000000770000-0x00000000007B0000-memory.dmp

Filesize
256KB

Download
memory/2448-8-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2448-9-0x0000000000490000-0x0000000000590000-memory.dmp

Filesize
1024KB

Download
memory/2448-3-0x0000000000770000-0x00000000007B0000-memory.dmp

Filesize
256KB

Download
memory/2448-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2448-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2448-11-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2448-14-0x0000000000770000-0x00000000007B0000-memory.dmp

Filesize
256KB

Download