6dc0f228e6144b2c69e72b7cd77be67f138a7a02c24752e893ba24c98ca8d993

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b16c404f3a6b9448709e7380a74edd4b_JaffaCakes118.exe
Size

1.0MB
MD5

b16c404f3a6b9448709e7380a74edd4b
SHA1

db1fde92339b79b5246de25b46ba96beefdc5883
SHA256

6dc0f228e6144b2c69e72b7cd77be67f138a7a02c24752e893ba24c98ca8d993
SHA512

68f4e485784dac33e5cab7d67ed9d1c48903c92ae3709d3e7694296203669b4817a10c0edfb71391b45842a4d692bfa480469540706e47083f317b61cf516def
SSDEEP

12288:iXxxiKDVkCtS/G/BMUNF+zxJByVXxC/xzzV0tuJhjcTY/kQEnEOSJ+K83YLwQwEL:ihx3+iSaM8FkByV25ekrcygnxSJ8YzD

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2552	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b16c404f3a6b9448709e7380a74edd4b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2552	2328	b16c404f3a6b9448709e7380a74edd4b_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2552	2328	b16c404f3a6b9448709e7380a74edd4b_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2552	2328	b16c404f3a6b9448709e7380a74edd4b_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2552	2328	b16c404f3a6b9448709e7380a74edd4b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\b16c404f3a6b9448709e7380a74edd4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b16c404f3a6b9448709e7380a74edd4b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\123.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\123.bat

Filesize
150B

MD5
0cd0479ad08e4c458f8e794ccc6ef9c3

SHA1
05710ebf549527193459c5049ceb239fc7e82b92

SHA256
053503d1b2d9820887d02d114176f48e5177ec74df26dc56a84386c31db5d98c

SHA512
ecf2af7a0ab453e5821643617d6a72fd93fc2d0d2827bde060e43113f296c96bd6923d6e261f909aac4acc1c401f4f6f636cc0547f29c3959c10f85ac903da89

Download Submit
memory/2328-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2328-9-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download