9b9e524fb01650309e92e5f706e04b909fbef71a4a3f2ab0aaf032bc4f4018f0

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
Size

63KB
MD5

951ef3e7ab23cf0d33c81a2076dd1807
SHA1

b9097dca9eebdfa459e3d9a5d31daac657556e3a
SHA256

9b9e524fb01650309e92e5f706e04b909fbef71a4a3f2ab0aaf032bc4f4018f0
SHA512

e6e1a37b8083be0b382d5db02a6916856e075152ae98aa3f22c2b6850d947683351a6f61ba6192c9a29f2a292e0b83e1643aa6ab7adaf3bbfd87abdf79e81733
SSDEEP

768:XdkoHXteEZ5LG1Xg22BdnCnfe7MwM3cEysLMalKqpmr8Q5pRnl/RjGo8gJG8eYoM:+xEZ1Q2vCGK5Vlg8Q5pl/HJPezDZz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 24 IoCs

pid	Process
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 384	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	3
PID 2460 wrote to memory of 384	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	3
PID 2460 wrote to memory of 384	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	3
PID 2460 wrote to memory of 384	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	3
PID 2460 wrote to memory of 384	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	3
PID 2460 wrote to memory of 384	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	3
PID 2460 wrote to memory of 384	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	3
PID 2460 wrote to memory of 392	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	4
PID 2460 wrote to memory of 392	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	4
PID 2460 wrote to memory of 392	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	4
PID 2460 wrote to memory of 392	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	4
PID 2460 wrote to memory of 392	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	4
PID 2460 wrote to memory of 392	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	4
PID 2460 wrote to memory of 392	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	4
PID 2460 wrote to memory of 420	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	5
PID 2460 wrote to memory of 420	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	5
PID 2460 wrote to memory of 420	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	5
PID 2460 wrote to memory of 420	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	5
PID 2460 wrote to memory of 420	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	5
PID 2460 wrote to memory of 420	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	5
PID 2460 wrote to memory of 420	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	5
PID 2460 wrote to memory of 480	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	6
PID 2460 wrote to memory of 480	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	6
PID 2460 wrote to memory of 480	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	6
PID 2460 wrote to memory of 480	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	6
PID 2460 wrote to memory of 480	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	6
PID 2460 wrote to memory of 480	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	6
PID 2460 wrote to memory of 480	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	6
PID 2460 wrote to memory of 496	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	7
PID 2460 wrote to memory of 496	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	7
PID 2460 wrote to memory of 496	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	7
PID 2460 wrote to memory of 496	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	7
PID 2460 wrote to memory of 496	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	7
PID 2460 wrote to memory of 496	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	7
PID 2460 wrote to memory of 496	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	7
PID 2460 wrote to memory of 504	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	8
PID 2460 wrote to memory of 504	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	8
PID 2460 wrote to memory of 504	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	8
PID 2460 wrote to memory of 504	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	8
PID 2460 wrote to memory of 504	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	8
PID 2460 wrote to memory of 504	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	8
PID 2460 wrote to memory of 504	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	8
PID 2460 wrote to memory of 600	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	9
PID 2460 wrote to memory of 600	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	9
PID 2460 wrote to memory of 600	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	9
PID 2460 wrote to memory of 600	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	9
PID 2460 wrote to memory of 600	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	9
PID 2460 wrote to memory of 600	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	9
PID 2460 wrote to memory of 600	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	9
PID 2460 wrote to memory of 676	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	10
PID 2460 wrote to memory of 676	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	10
PID 2460 wrote to memory of 676	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	10
PID 2460 wrote to memory of 676	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	10
PID 2460 wrote to memory of 676	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	10
PID 2460 wrote to memory of 676	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	10
PID 2460 wrote to memory of 676	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	10
PID 2460 wrote to memory of 752	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	11
PID 2460 wrote to memory of 752	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	11
PID 2460 wrote to memory of 752	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	11
PID 2460 wrote to memory of 752	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	11
PID 2460 wrote to memory of 752	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	11
PID 2460 wrote to memory of 752	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	11
PID 2460 wrote to memory of 752	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	11
PID 2460 wrote to memory of 812	2460	951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe	12

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:392
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:600
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1252
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:388
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:676
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:752
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:812
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1172
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:836
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:976
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:272
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1020
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1084
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1096
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1556
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2920
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1908
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:496
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:504

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\951ef3e7ab23cf0d33c81a2076dd1807_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2460

C:\Users\Admin\AppData\Local\Temp\4183285032\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\4183285032\zmstage.exe
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2460-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2460-2-0x00000000773F0000-0x00000000773F1000-memory.dmp

Filesize
4KB

Download
memory/2460-1-0x00000000773EF000-0x00000000773F0000-memory.dmp

Filesize
4KB

Download
memory/2460-3-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download