cde6cf494da932e219e033a65f12afefa00792351f1aed30257109bf45d78755

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a833b85e929be923537f78905a382c37_JaffaCakes118.exe
Size

476KB
MD5

a833b85e929be923537f78905a382c37
SHA1

0462f6e2e2d7a74d18e0d0b32d6a358c8a05de2b
SHA256

cde6cf494da932e219e033a65f12afefa00792351f1aed30257109bf45d78755
SHA512

80164880b33435e36146f2651b06a08660b1d7bf9e68959b4711a18ab154ba5375e234c40edb9e5be2eeb00216dd9c46e6d615c0e75ed5b55c489ffe1e167069
SSDEEP

6144:TjtisVV/LU/lgx0TJV//gBiRt9KxMtmkA2R3ddr92gjr2Shyk5lYw9J1WV/:f1VTju/L9wod0utX5+w9zI

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a833b85e929be923537f78905a382c37_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	DllHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2152	a833b85e929be923537f78905a382c37_JaffaCakes118.exe
2152	a833b85e929be923537f78905a382c37_JaffaCakes118.exe
2152	a833b85e929be923537f78905a382c37_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2300	2152	a833b85e929be923537f78905a382c37_JaffaCakes118.exe	30
PID 2152 wrote to memory of 2300	2152	a833b85e929be923537f78905a382c37_JaffaCakes118.exe	30
PID 2152 wrote to memory of 2300	2152	a833b85e929be923537f78905a382c37_JaffaCakes118.exe	30
PID 2152 wrote to memory of 2300	2152	a833b85e929be923537f78905a382c37_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\a833b85e929be923537f78905a382c37_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a833b85e929be923537f78905a382c37_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\DSCF2332.JPG
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2300

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\DSCF2332.JPG

Filesize
95KB

MD5
928d0088e8e6bf9d38fcd8bf5b9bae17

SHA1
d78815bc95b37981edde0cfaa9490fde16880a29

SHA256
0ba7e4e28383bfe5d5812ebf804d614539e190220d48af91dd99d3a518dba14d

SHA512
fac7901454b79e1a8d8b02cea7e3f4cc06f670b2d66da88833ba7c697639c0a83b10b127655d403070eb36bb7358e5cf8b8bd9fa4eea68827a249f4a6729988f

Download Submit
memory/2300-53-0x0000000000430000-0x0000000000432000-memory.dmp

Filesize
8KB

Download
memory/2728-54-0x0000000000100000-0x0000000000102000-memory.dmp

Filesize
8KB

Download