0be6dfc001d88f76b2cff4bfc7b8e0843a95f1bc219f9f071722e4a9a4e2b25e

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe
Size

220KB
MD5

b014b576f09a303f7a2bf70bf53d2732
SHA1

978b52d10d7255a36ddd05f209ab3b19fc32989b
SHA256

0be6dfc001d88f76b2cff4bfc7b8e0843a95f1bc219f9f071722e4a9a4e2b25e
SHA512

0ffb38ce23e286e59e33d1dd3727ec3b1d5cd2662d68e6329bb3b9f27861a34224cfe12b9138b9b671539b5959d89df04433e2f5dc296056bf3c8afae4dc889b
SSDEEP

6144:2Dj2bUvojo3noPGix+gbci3EcEycBdF7uuBQ:2DjEUH3A9+G3mFyu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1052	QHQS4AJ1J7NZRK.EXE
3044	QHQS4AJ2C8A.EXE

Loads dropped DLL 4 IoCs

pid	Process
2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe
2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe
2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe
2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QHQS4AJ1J7NZRK.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QHQS4AJ2C8A.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe
1052	QHQS4AJ1J7NZRK.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3044	QHQS4AJ2C8A.EXE
3044	QHQS4AJ2C8A.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1052	2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1052	2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1052	2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1052	2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe	29
PID 2224 wrote to memory of 3044	2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe	30
PID 2224 wrote to memory of 3044	2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe	30
PID 2224 wrote to memory of 3044	2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe	30
PID 2224 wrote to memory of 3044	2224	b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b014b576f09a303f7a2bf70bf53d2732_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224
- C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\QHQS4AJ1J7NZRK.EXE
  "C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\QHQS4AJ1J7NZRK.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\QHQS4AJ2C8A.EXE
  "C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\QHQS4AJ2C8A.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Local Settings\Application Data\81192114\tst

Filesize
10B

MD5
dfdaa4d245e453f865ce39b0b12b12ae

SHA1
3f709971c7a1f69d247e28eaf7dc53126c501823

SHA256
4823d7d21c7faade58b12c59b64ebed74c8014d757904fd7152d29240b4e6872

SHA512
2b83d351876158812155f1aa43fd1e2404f90b0f375f17f9b5d7a36bfb4211fe3a06124b3a1a807db5b2e0e265069e94b361425596e9c8867cb3bc05f5e72a67

Download Submit
\Users\Admin\AppData\Local\Temp\QHQS4AJ1J7NZRK.EXE

Filesize
220KB

MD5
b014b576f09a303f7a2bf70bf53d2732

SHA1
978b52d10d7255a36ddd05f209ab3b19fc32989b

SHA256
0be6dfc001d88f76b2cff4bfc7b8e0843a95f1bc219f9f071722e4a9a4e2b25e

SHA512
0ffb38ce23e286e59e33d1dd3727ec3b1d5cd2662d68e6329bb3b9f27861a34224cfe12b9138b9b671539b5959d89df04433e2f5dc296056bf3c8afae4dc889b

Download Submit
\Users\Admin\AppData\Local\Temp\QHQS4AJ2C8A.EXE

Filesize
24KB

MD5
af5401c79353d583aca0a40a0582f6dd

SHA1
1373e3f6b43c908681dc95acf9ddc534edb556b3

SHA256
9d0eac0d885b9b2e906dad4208f8cae1a0c826615fc4a8100f2cc0e636e771cd

SHA512
5f5320875719bd3007b12df07f80efac5b3e1cd0bb7edfe174cbf050557c2a483194bc0b7fd64acb8e29dd42149eed7d41ee1bbcd3ebcaf6fbbc608b20f5ca94

Download Submit