ab3089f90d7127a300dce2a5874a4a7b9e1f7f5a48d6c0bc78cbde74b86efc29

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe
Size

91KB
MD5

b5e1269f5e2404430bdc244c08f83c51
SHA1

81dc8e38c84a1d39658e9aad27759176379c4c03
SHA256

ab3089f90d7127a300dce2a5874a4a7b9e1f7f5a48d6c0bc78cbde74b86efc29
SHA512

1799f37b038709e4ed62f30f9e914014175a05612726f805bb0cd84adf08bb107ec950ef67ad305a1cbfcc3622abee6a8af815055162a1566cbd70f583a91d1b
SSDEEP

1536:vO0/rnFJA1OCQC3RK9YfJq/3UkMwRaUtdau7ULie:GWrFCOhaM9YY3UqRag/7Ur

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2100	m1.exe

Loads dropped DLL 2 IoCs

pid	Process
2640	b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe
2640	b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m1.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe
2640	b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe
2640	b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe
2100	m1.exe
2100	m1.exe
2100	m1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2100	2640	b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2100	2640	b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2100	2640	b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2100	2640	b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b5e1269f5e2404430bdc244c08f83c51_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\m1.exe
  m1.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\m1.exe

Filesize
360KB

MD5
1d81991d953159345569bf81b7a9a007

SHA1
6dc8f6070304e5889d810b2b786120fabc021e92

SHA256
2e446d21ceed686c7e6fced0806f6745dc7ea8b055513e001420adf1d0568e56

SHA512
9d7dea3f20aa29f376d2505dcf2da35f8c924a0b3bb7259541ebb4695f21b06103c5cdc3666785dabcb4376ce871fd5f8e6eedb33bccea5980e329adb0456f06

Download Submit
memory/2640-13-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download