04769a28278f5870a006aa5c5d845a6c8697e8c7ecff8eeccc58749259a7c690

Analysis

max time kernel
31s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe
Size

424KB
MD5

b291ef5817dc6b01a9f04fe923bf62d4
SHA1

54b0449200e1cc4cd5aea6555ea8b8640d8cc1a9
SHA256

04769a28278f5870a006aa5c5d845a6c8697e8c7ecff8eeccc58749259a7c690
SHA512

ecdf9c359cac84458f4ca6a39a7dbdb2453cdbf981bba790d71d169841efb270dc61d5eca45bd7e51cdbdb6e3dc6263210e482157e0c61dba4b0f9c08c091096
SSDEEP

12288:cqdyTcjd3E5bOdCltrQ02svb8KRgL622T:XdckREVIQQrCs62

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2692	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
316	Hacker.com.cn.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.com.cn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe
1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe
316	Hacker.com.cn.exe
316	Hacker.com.cn.exe
316	Hacker.com.cn.exe
316	Hacker.com.cn.exe
316	Hacker.com.cn.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	316	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe
316	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2692	1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe	31
PID 1548 wrote to memory of 2692	1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe	31
PID 1548 wrote to memory of 2692	1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe	31
PID 1548 wrote to memory of 2692	1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe	31
PID 1548 wrote to memory of 2692	1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe	31
PID 1548 wrote to memory of 2692	1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe	31
PID 1548 wrote to memory of 2692	1548	b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b291ef5817dc6b01a9f04fe923bf62d4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2692

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Hacker.com.cn.exe

Filesize
424KB

MD5
b291ef5817dc6b01a9f04fe923bf62d4

SHA1
54b0449200e1cc4cd5aea6555ea8b8640d8cc1a9

SHA256
04769a28278f5870a006aa5c5d845a6c8697e8c7ecff8eeccc58749259a7c690

SHA512
ecdf9c359cac84458f4ca6a39a7dbdb2453cdbf981bba790d71d169841efb270dc61d5eca45bd7e51cdbdb6e3dc6263210e482157e0c61dba4b0f9c08c091096

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
7350ea1dc0a7e17741aa273a074d31d6

SHA1
410ac0ec915e5f722cbe6490f776cd6b372acac4

SHA256
3250b72f5a8f7ce571a3bf4a020882ca9997ce5663860c5d49cda50e991225d6

SHA512
46a5686bbd961631a236d00f3e8bb458799d00753c421f0c64d5800aa5a1e1269ab7c9f64f1e34fd1b57a73131808cea2362b297bb995cf28a329da0cdac0d7c

Download Submit
memory/316-6-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1548-0-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1548-5-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download