6865261f83b69e6bf5802bb3c414544f6b37bdc4a5cb5360943e851cb14e3e9b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9c7d7b532e9d524a8a24a57512adf5f_JaffaCakes118.exe
Size

31KB
MD5

b9c7d7b532e9d524a8a24a57512adf5f
SHA1

ce17f20127ce2952be57bbb438a7292f80d891bd
SHA256

6865261f83b69e6bf5802bb3c414544f6b37bdc4a5cb5360943e851cb14e3e9b
SHA512

de91997b2e31ec0a6164b31de79622097c94c7f6cac79fcf87c15dc67498c296bd5c11da784a10d1cb990ae48e9e4d994f910aca805e59514f601d10da32a66c
SSDEEP

384:2TiUFcF7nQhRB4CSeCD1fUcN8Z+mXK1UL8KsdLpcsPC:2eUqRQR4HxD1fUcNbma1UL8KsdLpcs6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1732	nodelete.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\nodelete.exe	b9c7d7b532e9d524a8a24a57512adf5f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9c7d7b532e9d524a8a24a57512adf5f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
756	b9c7d7b532e9d524a8a24a57512adf5f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1732	756	b9c7d7b532e9d524a8a24a57512adf5f_JaffaCakes118.exe	31
PID 756 wrote to memory of 1732	756	b9c7d7b532e9d524a8a24a57512adf5f_JaffaCakes118.exe	31
PID 756 wrote to memory of 1732	756	b9c7d7b532e9d524a8a24a57512adf5f_JaffaCakes118.exe	31
PID 756 wrote to memory of 1732	756	b9c7d7b532e9d524a8a24a57512adf5f_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\b9c7d7b532e9d524a8a24a57512adf5f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b9c7d7b532e9d524a8a24a57512adf5f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\nodelete.exe
  C:\Windows\nodelete.exe
  2⤵
  - Executes dropped EXE
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\nodelete.exe

Filesize
7KB

MD5
65cdfe4f153b52c56b142bd845106932

SHA1
164069f167410966b38484159350152af6d8285a

SHA256
68a0e1f914369baa410078c633e0679a606e23d0f2224e9d3dc100f6317f292b

SHA512
baabcfdb478d2942fc53db50f106a3b51498d5d468c1ff9b38205388d2306ed29ea1722602ac38e6135ef1316bf48293ce45358e9d6c9b30cce03dae60c99439

Download Submit