94a63d93b9266b23a006a80b05b65eee885aecba53d2eda48f920580209dbfa0

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe
Size

237KB
MD5

b557f0af03b1e60938923ad40a26d8e0
SHA1

80f19548f4ce34ee2b62fadf360f244d998ac568
SHA256

94a63d93b9266b23a006a80b05b65eee885aecba53d2eda48f920580209dbfa0
SHA512

c7009bdfd7ad6c5b94ad61fa0e0ce1f8bfde9eb23c3487fee750b31a7f409e020dcb819fa3c6eb59dcb41aa38d0f6eb30d1381687ceee929cc34ca13450fe438
SSDEEP

3072:QNBg56EuMelmameAJBZQJfQWzQQcvPoVrRwDHn:QNhMUmVmJfFQQcnoVy

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2740	RASPPPOE.EXE

Loads dropped DLL 4 IoCs

pid	Process
1732	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe
2740	RASPPPOE.EXE
2740	RASPPPOE.EXE
2740	RASPPPOE.EXE

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RASPPPOE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2740	1732	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2740	1732	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2740	1732	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2740	1732	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2740	1732	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2740	1732	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2740	1732	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\RSPE200E.TMP\RASPPPOE.EXE
  RASPPPOE.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\RSPE200E.TMP\RASPPPOE.EXE

Filesize
33KB

MD5
a145e58da9a4914d9dfd1a5ae016fa7c

SHA1
5506e947ae9501fc4275464192b990ba1869dcf3

SHA256
425a282a70b761505162353bd65b4b21da3fbe7dcf1954b37fee8e832aa2bac0

SHA512
3a2f8c8a6150eb5799f0a126f47732baf411790e7366f752606abc4e9afcd2e06b66ede57db66a089e074fa6d9f988b7435f336e09c65a974155c6b264bf6cbf

Download Submit