9978da3dd1958f85cb65d5fcf7ecfb95eefc49f36f696880c0dd77707c0f20d3

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b64de04bb435cb4762808294adb26325_JaffaCakes118.exe
Size

216KB
MD5

b64de04bb435cb4762808294adb26325
SHA1

caf936e32045e3e080d4aae1b451559d45cb4aae
SHA256

9978da3dd1958f85cb65d5fcf7ecfb95eefc49f36f696880c0dd77707c0f20d3
SHA512

df4d40138919d702085dacac471d7459ffaed4285bcfc68a26c3c035449d00da74fe1788e8de34cdc6d03c8d6f0288d4ae2c1d03c9a4669dff4b26b8b600e155
SSDEEP

6144:gTB7v/uFrJTCb9fPz1OA1iQ9sJDDkZ/swjUHd9mcfzGOD0ZZAFpv:gTVv/uRJTCpgdQmh4Z/29BfCRZin

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1120	@F8E0.tmp

Loads dropped DLL 2 IoCs

pid	Process
2488	b64de04bb435cb4762808294adb26325_JaffaCakes118.exe
2488	b64de04bb435cb4762808294adb26325_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@F8E0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b64de04bb435cb4762808294adb26325_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1120	2488	b64de04bb435cb4762808294adb26325_JaffaCakes118.exe	29
PID 2488 wrote to memory of 1120	2488	b64de04bb435cb4762808294adb26325_JaffaCakes118.exe	29
PID 2488 wrote to memory of 1120	2488	b64de04bb435cb4762808294adb26325_JaffaCakes118.exe	29
PID 2488 wrote to memory of 1120	2488	b64de04bb435cb4762808294adb26325_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\b64de04bb435cb4762808294adb26325_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b64de04bb435cb4762808294adb26325_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\@F8E0.tmp
  "C:\Users\Admin\AppData\Local\Temp\@F8E0.tmp" "C:\Users\Admin\AppData\Local\Temp\b64de04bb435cb4762808294adb26325_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\@F8E0.tmp

Filesize
80KB

MD5
36270608c435e396dda65fd5f8d2ac4e

SHA1
05fc1d7ec7ea1e8c06f351344e537a7472452b18

SHA256
d8835cbf48a6b3b12c43951ec6178ff1ddc6b40498fc11f73230858225c090f2

SHA512
37298d643f0ad4585039168b975f7f44ca2fd5d64d78e1a9759a867e8cc4b47aca7e7b1fc89f54a372fe45d84c4384b4ac218052a4af84a57ec5c11e69f620c5

Download Submit