496e0dcb004cb18cf6943df0d15061098cefd02db201a5e99126131d73f91856

Analysis

max time kernel
0s
max time network
4s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe
Size

84KB
MD5

95d2ed79649aa99c376506b023cf87b8
SHA1

53ba29bc911f8c008ec0404a7a12eb375a239b62
SHA256

496e0dcb004cb18cf6943df0d15061098cefd02db201a5e99126131d73f91856
SHA512

64057f51efccdf84e71bf6fec277f096e0b8ce85c46c34aec0b0133574f1d94259076e7a51f5010103f01797642fb0548a8599c534cad6df54ea2f3d3c2d2a18
SSDEEP

768:DAt8DlVQu+I+UWHQOLzNq+A1WuptrknoFuhTtdOLi7JKFHjP+Gh8d4Wp2NzI1U2x:4CR+LzNDkW4t1ATtdOLieHq88d4WpBN

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2752	TVCkbu.tmp

Loads dropped DLL 2 IoCs

pid	Process
2128	95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe
2128	95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TVCkbu.tmp

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2128	95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe
2752	TVCkbu.tmp
2752	TVCkbu.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2128	95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2752	2128	95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2752	2128	95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2752	2128	95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2752	2128	95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\95d2ed79649aa99c376506b023cf87b8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Public\Videos\TVCkbu.tmp
  "C:\Users\Public\Videos\TVCkbu.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Public\Videos\TVCkbu.tmp

Filesize
30KB

MD5
80a5e45a59ef3560a9fcde5479c00651

SHA1
e9663ce428029600c2ce8e5207be941522bfa5fa

SHA256
f4355f68cb79fb3661d905b51a6d469185c085214be06b4e850a9b62d36a7999

SHA512
ccdde9bba16f8915f2c24744c7760a153cbfb1640e0487dec3254fce12f118a88fa9692a6c27155b822a0f220892c204eff56493c42d9a8a2e584a88b3243ac0

Download Submit
memory/2128-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2128-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download