12c68d93c4fed89011f075f40090ef4ab00c80ac72a81459fdb603e40f6cce86

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe
Size

88KB
MD5

b4a4d9e6e5f2f11287f97b3595b0ec84
SHA1

439718b7e65c62a1be19cb9bbcea474ed58ec01a
SHA256

12c68d93c4fed89011f075f40090ef4ab00c80ac72a81459fdb603e40f6cce86
SHA512

1e9871c981d9af7e2da15692873ad4b262bb51f0b02c02d2ea44b6f8ece83e6ba1c3b2d6985c3529abc9f63d1f12de3a3c02c685a3b2da98842f5cd431ed3c8b
SSDEEP

1536:eDlDGe4exHmMMweNypcc/mttfxJCgej1/5:cDGeAwMDc/mttfxJCgejT

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
316	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
316	cmd.exe
2256	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2256	PING.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1984	b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe
1984	b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe
1984	b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 316	1984	b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe	31
PID 1984 wrote to memory of 316	1984	b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe	31
PID 1984 wrote to memory of 316	1984	b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe	31
PID 1984 wrote to memory of 316	1984	b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe	31
PID 316 wrote to memory of 2256	316	cmd.exe	33
PID 316 wrote to memory of 2256	316	cmd.exe	33
PID 316 wrote to memory of 2256	316	cmd.exe	33
PID 316 wrote to memory of 2256	316	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c echo ping 127.1 -n 3 >nul 2>nul >c:\zc.bat&echo del "C:\Users\Admin\AppData\Local\Temp\b4a4d9e6e5f2f11287f97b3595b0ec84_JaffaCakes118.exe">>c:\zc.bat&echo del c:\zc.bat>>c:\zc.bat&c:\zc.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.1 -n 3
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\zc.bat

Filesize
125B

MD5
0851a7cabda45c24e230777a2b4e9f11

SHA1
bb99ecca172c93c152a3b102e0ef313dcec54334

SHA256
648152b0fe324256b3052c1d4efa42e79146fe20716ed831ee964b553aa47fbc

SHA512
d3d71efdfe1d60f8cdead714beaabaed6c5b72d0be0bcb486d4667e919b3a6496bf365876b76839e62d3543965ae79a9d363dfd5527ad9fcbfa0c57486c7d4a9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads