d23751e145239621642b7b724a52229ba20be60a85d3fa2ef38ca6dec54edbf6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b489b3ea59b1f02dbbdde3ed551ba155_JaffaCakes118.exe
Size

191KB
MD5

b489b3ea59b1f02dbbdde3ed551ba155
SHA1

0c989f012a5706f7c4e54051c8d04e7507e6d6ce
SHA256

d23751e145239621642b7b724a52229ba20be60a85d3fa2ef38ca6dec54edbf6
SHA512

031fabdc4a84279f48884f8c92e8a8e6335e88ddbe57b3302d80466a675a38a1ba31f62c3e4e343455c5a6a4cab348b6c594fff7d84b81dc0a9390e9cce52b2a
SSDEEP

3072:gBUIYrsgIDmJxsuIlh/5VU6NwKaIHvfQEjswSh76c9Sn0WjXVcPYe3MSAlcW6cQU:gGsbuIr/TvwKRHgEjsH9SnJVcPYq3W6U

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\hcpidesk.sys	b489b3ea59b1f02dbbdde3ed551ba155_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\hcpidesk.sys	b489b3ea59b1f02dbbdde3ed551ba155_JaffaCakes118.exe

Loads dropped DLL 3 IoCs

pid	Process
3056	b489b3ea59b1f02dbbdde3ed551ba155_JaffaCakes118.exe
3056	b489b3ea59b1f02dbbdde3ed551ba155_JaffaCakes118.exe
3056	b489b3ea59b1f02dbbdde3ed551ba155_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b489b3ea59b1f02dbbdde3ed551ba155_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

C:\Users\Admin\AppData\Local\Temp\b489b3ea59b1f02dbbdde3ed551ba155_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b489b3ea59b1f02dbbdde3ed551ba155_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dosss11.dll

Filesize
76KB

MD5
5e44b322750a6faa37c8a22b8e630e76

SHA1
a3666de66496d3d045968dfe83edc92762bed830

SHA256
635d9af89fd1671980d32114ba544a34fdfe228786b87ae4f08261f2a47d2bbb

SHA512
dcce738f4681914e53bcde8603f1bc9cbf88f5582f5dffec45f62b6729fc4aed5ccb5f2bf68adfb248b35e42a58728e04ec2daae4be28bd7f492e57a23eb63f9

Download Submit
\Users\Admin\AppData\Local\Temp\nsjD24F.tmp\System.dll

Filesize
10KB

MD5
bf01b2d04e8fad306ba2f364cfc4edfa

SHA1
58f42b45ca9fc1818c4498ecd8bac088d20f2b18

SHA256
d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903

SHA512
30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7

Download Submit
memory/3056-12-0x0000000000340000-0x0000000000355000-memory.dmp

Filesize
84KB

Download