436cfffc6fa33c887f2210cea2fc5b6985b72f31df4ea6e6b8fb47dbf4723af0

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe
Size

236KB
MD5

abaa270306f936af71f56634a0a7ca96
SHA1

f7d79e02706c4cfc81a9124852c67ffcb23c38ff
SHA256

436cfffc6fa33c887f2210cea2fc5b6985b72f31df4ea6e6b8fb47dbf4723af0
SHA512

0742d06edf8015245faab67531424fb385b8321c24506d4deefef4e0ab65bb5cdfcf6c18bffded667321488c281f6128a02b48c50cf4c00c60148f641eb0e0e3
SSDEEP

3072:IE6GKuqZqje6pVtlCia5NZVYLZhpm0JJB1a3rmo:IE6NQTBiVYL9m0vB1emo

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\lpk.dll	abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe
File created	C:\Windows\lpkbackup.dll	abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe
File opened for modification	C:\Windows\ppastream.dat	panzerfive.exe
File created	C:\Windows\TestDll.dll	panzerfive.exe
File created	C:\Windows\ppastream.dat	abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe
File created	C:\Windows\lpkreal.dll	abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	panzerfive.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2584	abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3004	panzerfive.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 3004	2584	abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe	30
PID 2584 wrote to memory of 3004	2584	abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe	30
PID 2584 wrote to memory of 3004	2584	abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe	30
PID 2584 wrote to memory of 3004	2584	abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\abaa270306f936af71f56634a0a7ca96_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\panzerfive.exe
  C:\Windows\panzerfive.exe
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ppastream.dat

Filesize
129B

MD5
dea81d601bf0d5d720b990df52b16c55

SHA1
104bc2e519626a159f818bf3687aa3f3d8082c5b

SHA256
d6b90b671737741e0c834d7dffeaf45ac188c05c6676917da3a8664ca265671f

SHA512
8f63f8c1e27c37be3c3b8e65953a94a8d03b3ae7ca3939f6b9d70169a5430270e94b7b33c9785879800d3a42b02e089798473164fc3034b3119adf968d73f303

Download Submit
memory/2584-4-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download