55c4dc774aa819a13fb0262e3966634e181ba71bec1ff23d51e8b2555d0735ae

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe
Size

40KB
MD5

a5051b91f5c7c8c5ed08a2558fe4bb9a
SHA1

87607a53c174f8a417c02d19552026dff0221405
SHA256

55c4dc774aa819a13fb0262e3966634e181ba71bec1ff23d51e8b2555d0735ae
SHA512

5553b28945ba812515c8716b6502325bbf946c0017dd6a3d9cf2504fc8bbc9bb8a622a1f356fdb26985a11fe5964120551ea6f635ec067768d00fd7988dd8b14
SSDEEP

768:I2Mlp5koanBLyLXW0ObQXkvjUWJpy0aTWgia7ARblReaOub1Q:Iz5oBLqXW0IQXkLUWJpy0uTkRblaub1Q

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\braviax = "C:\\Windows\\system32\\braviax.exe"	a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\braviax = "C:\\Windows\\system32\\braviax.exe"	a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\braviax.exe	a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2776	2152	a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe	30
PID 2152 wrote to memory of 2776	2152	a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe	30
PID 2152 wrote to memory of 2776	2152	a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe	30
PID 2152 wrote to memory of 2776	2152	a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a5051b91f5c7c8c5ed08a2558fe4bb9a_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\delself.bat

Filesize
230B

MD5
71d15526a1a741e00ea5b570bd34c1bb

SHA1
ba353e113f29f0dd4dacd69720510624718b0281

SHA256
9739d673fd64571c4e527aafbb3c6cc26c0355a740bef3d855aaf81afe813d13

SHA512
9dbe3bba4ca9501f7fb506332360c9753046ceacf75b218f2e0ac077e659cc7508a1faf49ebde4442ff9fa486954f52f594d433c52f0f99cdb4fb1cfad2837f6

Download Submit
memory/2152-4-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2152-3-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2152-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads