b2aeeb4c0ef9514322bcdbe6e6aa5ac14e89468c1bd89f1c9bcbc4c8b2cd4083

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

976f5336536e691e0395eadd172c09b5_JaffaCakes118.exe
Size

105KB
MD5

976f5336536e691e0395eadd172c09b5
SHA1

118f8113f5aeb6a2a2019e5f2155189e3f6e3f7b
SHA256

b2aeeb4c0ef9514322bcdbe6e6aa5ac14e89468c1bd89f1c9bcbc4c8b2cd4083
SHA512

7fa1f30cb44f83212433aa7051c8c49bdf861d57fcb70a53e0cb7dbcc76aac64a2aeca095925738b16e4c9c0430c45426f323542ff7d63671348f7a84c3071b5
SSDEEP

1536:5NrTZSSJw8oD5mmiKoBHgiLUffXWpkSv8652xDc7Q+BYrj76M:fTZhzoGlvLUnmn860c7LgX6M

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	976f5336536e691e0395eadd172c09b5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2724	2672	976f5336536e691e0395eadd172c09b5_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2724	2672	976f5336536e691e0395eadd172c09b5_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2724	2672	976f5336536e691e0395eadd172c09b5_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2724	2672	976f5336536e691e0395eadd172c09b5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\976f5336536e691e0395eadd172c09b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\976f5336536e691e0395eadd172c09b5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Xqf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Xqf..bat

Filesize
238B

MD5
99d106fc4801c7bb03911098410f89d0

SHA1
c1233b6fed80cad6df5a1772feaf5ad5b49a40e9

SHA256
d211f8066465d8274637dd0250a94bb1177451ae547ee28c12dec2d95eed54a7

SHA512
21c125218a250da3d6d6a8022cb63a1f30f1ba1107f7e0551592d7f0f17b1b06a3b655671d9a45e6ab18984181e8515819eda7fb89c6783f6dd71eeaad89e005

Download Submit
memory/2672-3-0x000000000041F000-0x0000000000421000-memory.dmp

Filesize
8KB

Download
memory/2672-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2672-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download