Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 14:37
Behavioral task
behavioral1
Sample
9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe
-
Size
14KB
-
MD5
9680030bd03d17653c63b4731ee91111
-
SHA1
92a8a08bf05254baab19360672888a8d08c26a58
-
SHA256
376c466871ff1fa4dbc4ab1b523fda7c71e25501f87acb7a674d20ebab2178d8
-
SHA512
9b3638e6719f34bbcb1b8ea807abb1980bf9123cb14074f1a745aa130abd9c3baeef1334012408e622ef61f1083daf5fc661022878c0280a0ee738bbd2574f72
-
SSDEEP
384:k4Ful4tuVdqYVTcD6OYf436uLwXLJ9EJKskAB:kT6Cg4cDy439wLsX
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Executes dropped EXE 1 IoCs
pid Process 1240 cenbeznk.exe -
resource yara_rule behavioral2/memory/1796-0-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral2/files/0x0007000000023497-4.dat upx behavioral2/memory/1796-6-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral2/memory/1240-7-0x0000000000400000-0x0000000000411000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cenbeznk.exe 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe File created C:\Windows\SysWOW64\cenbezn.dll 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe File created C:\Windows\SysWOW64\cenbeznk.exe 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cenbeznk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1796 wrote to memory of 1240 1796 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 84 PID 1796 wrote to memory of 1240 1796 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 84 PID 1796 wrote to memory of 1240 1796 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 84 PID 1796 wrote to memory of 5032 1796 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 96 PID 1796 wrote to memory of 5032 1796 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 96 PID 1796 wrote to memory of 5032 1796 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cenbeznk.exeC:\Windows\system32\cenbeznk.exe ˜‰2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1240
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe.bat2⤵
- System Location Discovery: System Language Discovery
PID:5032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD5c86a0c4cd09c1128138d449618f92043
SHA10794204d79c5be2453eb04d80c073dd7507f926b
SHA256520a17401eb6811c99113794a55bdda21071392c8e73090e6618517306d33007
SHA5129eeac7185b047a1679be3ad3c5cb8650bba91556a42c385342872ca5a9721d3f9688d1e7447e6686e840e61280f53036c9a271706250c851f65ac345c7fb315e
-
Filesize
14KB
MD59680030bd03d17653c63b4731ee91111
SHA192a8a08bf05254baab19360672888a8d08c26a58
SHA256376c466871ff1fa4dbc4ab1b523fda7c71e25501f87acb7a674d20ebab2178d8
SHA5129b3638e6719f34bbcb1b8ea807abb1980bf9123cb14074f1a745aa130abd9c3baeef1334012408e622ef61f1083daf5fc661022878c0280a0ee738bbd2574f72