7054942fbb1ddac0dfeb303d8838f455500077093a49677677b43d115e96be13

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe
Size

131KB
MD5

b12b3cf3931da7bb6306289e16817c95
SHA1

d83fa51a17db52ef129a6aa850815a8c97c0fc6b
SHA256

7054942fbb1ddac0dfeb303d8838f455500077093a49677677b43d115e96be13
SHA512

76798e133e66ddc1b75b316769bb26013698398891dcd1c4fcf5783f0a6e87b1847f36d0e7264f981071a86ef27e9ab6482c89f8836405d11783dbd0a989dfb7
SSDEEP

3072:sYP2XerzhOUxu/XUtauYp5pNhqkBRfk0/FgXac:su2urzh9xu/XkauY3pjJFc

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_259472500	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe
File created	C:\Windows\NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe
File opened for modification	C:\Windows\NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe

Suspicious behavior: MapViewOfSection 23 IoCs

pid	Process
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2732	2916	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2732	2916	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2732	2916	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2732	2916	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2732	2916	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2732	2916	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2732	2916	b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe	30
PID 2732 wrote to memory of 384	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	3
PID 2732 wrote to memory of 384	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	3
PID 2732 wrote to memory of 384	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	3
PID 2732 wrote to memory of 384	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	3
PID 2732 wrote to memory of 384	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	3
PID 2732 wrote to memory of 384	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	3
PID 2732 wrote to memory of 392	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	4
PID 2732 wrote to memory of 392	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	4
PID 2732 wrote to memory of 392	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	4
PID 2732 wrote to memory of 392	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	4
PID 2732 wrote to memory of 392	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	4
PID 2732 wrote to memory of 392	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	4
PID 2732 wrote to memory of 432	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	5
PID 2732 wrote to memory of 432	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	5
PID 2732 wrote to memory of 432	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	5
PID 2732 wrote to memory of 432	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	5
PID 2732 wrote to memory of 432	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	5
PID 2732 wrote to memory of 432	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	5
PID 2732 wrote to memory of 476	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	6
PID 2732 wrote to memory of 476	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	6
PID 2732 wrote to memory of 476	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	6
PID 2732 wrote to memory of 476	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	6
PID 2732 wrote to memory of 476	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	6
PID 2732 wrote to memory of 476	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	6
PID 2732 wrote to memory of 488	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	7
PID 2732 wrote to memory of 488	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	7
PID 2732 wrote to memory of 488	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	7
PID 2732 wrote to memory of 488	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	7
PID 2732 wrote to memory of 488	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	7
PID 2732 wrote to memory of 488	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	7
PID 2732 wrote to memory of 496	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	8
PID 2732 wrote to memory of 496	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	8
PID 2732 wrote to memory of 496	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	8
PID 2732 wrote to memory of 496	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	8
PID 2732 wrote to memory of 496	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	8
PID 2732 wrote to memory of 496	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	8
PID 2732 wrote to memory of 596	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	9
PID 2732 wrote to memory of 596	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	9
PID 2732 wrote to memory of 596	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	9
PID 2732 wrote to memory of 596	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	9
PID 2732 wrote to memory of 596	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	9
PID 2732 wrote to memory of 596	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	9
PID 2732 wrote to memory of 672	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	10
PID 2732 wrote to memory of 672	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	10
PID 2732 wrote to memory of 672	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	10
PID 2732 wrote to memory of 672	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	10
PID 2732 wrote to memory of 672	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	10
PID 2732 wrote to memory of 672	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	10
PID 2732 wrote to memory of 756	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	11
PID 2732 wrote to memory of 756	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	11
PID 2732 wrote to memory of 756	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	11
PID 2732 wrote to memory of 756	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	11
PID 2732 wrote to memory of 756	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	11
PID 2732 wrote to memory of 756	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	11
PID 2732 wrote to memory of 816	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	12
PID 2732 wrote to memory of 816	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	12
PID 2732 wrote to memory of 816	2732	NEPAL-YAHOO NCC CRACKER BY USTAD1.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1580
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1576
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:816
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1376
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:852
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:236
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1008
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:296
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1312
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1080
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2880
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2904
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1428
- C:\Users\Admin\AppData\Local\Temp\b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b12b3cf3931da7bb6306289e16817c95_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\WINDOWS\NEPAL-YAHOO NCC CRACKER BY USTAD1.exe
    "C:\WINDOWS\NEPAL-YAHOO NCC CRACKER BY USTAD1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\NEPAL-YAHOO NCC CRACKER BY USTAD1.exe

Filesize
44KB

MD5
40d7f8db372e81e98e0df76a1268ba64

SHA1
c0e5f4b512237a1e006c7dc96d52a632f690cd31

SHA256
246e31661020a19749fcc13c38866bb9393ac0c5faeb6864a452596b9b122032

SHA512
8f8a2965f3c39c469382996039b0324070dec1f21d133199783e04b45eec2dc32c3a3126c03c61ec5491461920e8e44c9ca59b415d07709c81fb3e54ff37c454

Download Submit
memory/1428-15-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1428-21-0x000000007EFB0000-0x000000007EFB6000-memory.dmp

Filesize
24KB

Download
memory/2732-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2732-14-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2732-11-0x0000000077A90000-0x0000000077A91000-memory.dmp

Filesize
4KB

Download
memory/2732-12-0x0000000077A8F000-0x0000000077A90000-memory.dmp

Filesize
4KB

Download
memory/2732-33-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2732-34-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2916-9-0x0000000000980000-0x000000000098E000-memory.dmp

Filesize
56KB

Download
memory/2916-8-0x0000000000980000-0x000000000098E000-memory.dmp

Filesize
56KB

Download