90bacf86771ffef883e193b2a3d65bf718899713645778f1bdc29ddfceb6a2a6

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4a78e723c1dff1ecad67b53578ac7e8_JaffaCakes118.exe
Size

109KB
MD5

b4a78e723c1dff1ecad67b53578ac7e8
SHA1

891540255e9b51993e44078e3c463d7828b2abd6
SHA256

90bacf86771ffef883e193b2a3d65bf718899713645778f1bdc29ddfceb6a2a6
SHA512

7359de350cc9a2bdfd63acd33be1fec70e1ca284bdcbfe6f3a270dc042066c3366c4b7913157812b92617279472bc32f3ced19e521b211c552da8f9b085c42f0
SSDEEP

1536:KFzamKJ/9x9LUGOnVZPxhRwk+L4eH+TMCwxMSnY9vLYVNRQtEme4wBuHDyThd/IR:K9amc9x9gBxv+SQtxMSnYRLrVTwwjXh

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2000	b4a78e723c1dff1ecad67b53578ac7e8_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\od3mdi.dll	b4a78e723c1dff1ecad67b53578ac7e8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4a78e723c1dff1ecad67b53578ac7e8_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
2000	b4a78e723c1dff1ecad67b53578ac7e8_JaffaCakes118.exe
476	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2000	b4a78e723c1dff1ecad67b53578ac7e8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b4a78e723c1dff1ecad67b53578ac7e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4a78e723c1dff1ecad67b53578ac7e8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\od3mdi.dll

Filesize
238KB

MD5
7fe7a3c2b1699fa4ce3fb025820329ec

SHA1
e3b8968f9c50ddd46a5e422490ef91a5675efa66

SHA256
49fe459e74c55a66809299a5e52312582afb129e10b10efd0c91d201e5e6dc8c

SHA512
229b3bc697b8b16b4616c49e1812fa6846c40418fef65a7d195594e818c94f77df2a7ab97c086a79f3bf98bc3a0c69268244893e11ae3704c3ee4e2a745bcb76

Download Submit
memory/2000-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-3-0x0000000001BC0000-0x0000000001C08000-memory.dmp

Filesize
288KB

Download
memory/2000-5-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download