c3830be8073ceca58399ea5f494cbfa20f3789064f2dcecb9f6cb5f282c31b94

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a46514326d7944a86c508fb64bc19c1a_JaffaCakes118.exe
Size

756KB
MD5

a46514326d7944a86c508fb64bc19c1a
SHA1

cbc90c9748added98f7bf2035f8334b5a1d63452
SHA256

c3830be8073ceca58399ea5f494cbfa20f3789064f2dcecb9f6cb5f282c31b94
SHA512

950441c00dd1ec43d77ff7d361739752a92b820beef758fbf36c77c939752289294f11a858dbefb96f186ddff0e3ae9798a9deaaf8dbd235a0e7d92aecd777e3
SSDEEP

12288:lRn8S++U4u/n/80dW5A0zyo6JwQ5oAlK+GwHv7hIkwfQQ52LYRg08yPwJRBy:P8MU4ufxdW5A2mJr/kSHvVIkwz3S

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PRogram Files\windows update.exe	a46514326d7944a86c508fb64bc19c1a_JaffaCakes118.exe
File opened for modification	C:\PRogram Files\windows update.exe	a46514326d7944a86c508fb64bc19c1a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a46514326d7944a86c508fb64bc19c1a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	a46514326d7944a86c508fb64bc19c1a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a46514326d7944a86c508fb64bc19c1a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a46514326d7944a86c508fb64bc19c1a_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2192-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2192-4-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download