92e05eb8c6149802e9594c6be7891e4b5e9daaa581b2811ee136693e2e421ddf

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe
Size

284KB
MD5

ac21f94bf0c8e55611d93d2be5b49cc9
SHA1

b2e07e7f36474a29c95f73bbb0c80fdc9f16b223
SHA256

92e05eb8c6149802e9594c6be7891e4b5e9daaa581b2811ee136693e2e421ddf
SHA512

020b1da703c510b15b6c7c96b4dba21bd8c991b42090f96d742414a2a63defacec82a4547ed35181b626ebbf70c189684cb5abfd424be55a641cfb3689f4df70
SSDEEP

6144:gu2urzh9xu/XkauBN71DVkm6SlH1Tc25Zxm4NjNdihw49n0LM1A:gutrzh9xOXk71DVSyH1Q2xmg+j9n5m

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
860	view.exe

Loads dropped DLL 2 IoCs

pid	Process
2608	ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe
2608	ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	view.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 860	2608	ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe	31
PID 2608 wrote to memory of 860	2608	ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe	31
PID 2608 wrote to memory of 860	2608	ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe	31
PID 2608 wrote to memory of 860	2608	ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe	31
PID 2608 wrote to memory of 860	2608	ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe	31
PID 2608 wrote to memory of 860	2608	ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe	31
PID 2608 wrote to memory of 860	2608	ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac21f94bf0c8e55611d93d2be5b49cc9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\view.exe
  "C:\Users\Admin\AppData\Local\Temp\view.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\view.exe

Filesize
457KB

MD5
00ace6b02f87a9b3431a024be59a2da1

SHA1
6b44e1006bf032e75d9a3eaac919b448f2ec021e

SHA256
d3044e12b1c31cbac0aee8789bb442aa1e6b6880ae7f05390bffb4dc47067ddd

SHA512
493b316557d3df83c7150d6300985e8181576ef1c6d297e7660caf35d901ddbda00073d8dc8e9fd7783807f2360057192830cb647f2929d5570b0b336aed12a1

Download Submit
memory/860-10-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/860-11-0x0000000004090000-0x000000000410A000-memory.dmp

Filesize
488KB

Download