7c86f9c3b1f8247e961d9186105c1c1f52e12423b5e3f0fdbee0ef2142ff534f

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe
Size

256KB
MD5

ba433b48963e5867305d0a0885e2f1a9
SHA1

95b3e061b6b1943f5f6d62738ebf05a04add7128
SHA256

7c86f9c3b1f8247e961d9186105c1c1f52e12423b5e3f0fdbee0ef2142ff534f
SHA512

b40e16c6e960e01ea41c9f08c182858d54ef5f96f752b24b2669f7a1397a4b434a18ee9c483d2f5b3b7f3805108f62399b0566c5b70e58c9b5009ac90b65332d
SSDEEP

6144:uQjLyQVSpPD9gtefEsp4yxQA8p9NbZDBV+9eIeuRbZ7n7rma:uQQD9gt4PRxoNPs9eIn73

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI5	ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2408	ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe
2408	ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1188	2408	ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe	21
PID 2408 wrote to memory of 1188	2408	ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe	21
PID 2408 wrote to memory of 1188	2408	ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe	21
PID 2408 wrote to memory of 1188	2408	ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ba433b48963e5867305d0a0885e2f1a9_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\PCGWIN32.LI5

Filesize
2KB

MD5
7ae1061763ebbec2e8a2892a05fe669a

SHA1
0951458d7891a4ef3e6c5abb820de391b1552223

SHA256
08ba300c0741ff560714aaf54489abcbcec81dfcf43ed21bc5bb1ab422a4d471

SHA512
10bcb8512e8ea4b31f6a9525592c2c342093e66a426306f72f14a259bff16f6685ddfb3053665f0461e1d12c74cd99783998d98e567e326dba04037d104a88f9

Download Submit
memory/1188-15-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1188-18-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2408-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2408-13-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2408-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2408-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2408-29-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2408-27-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download