49086334db30e89281ca3ddc04f48c8339c22ede98a276ddc494f09022ab199f

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcb80a7baae4d1e64b1f30f9252b5129_JaffaCakes118.exe
Size

109KB
MD5

bcb80a7baae4d1e64b1f30f9252b5129
SHA1

ac1842b60b0be9250e66a39276ed32e7f709ef02
SHA256

49086334db30e89281ca3ddc04f48c8339c22ede98a276ddc494f09022ab199f
SHA512

8ecc2751864d61ae2469b5291c5e55c593aa59853fbb930a5fdf657f86b1b15213fc1ea7937bb87afe35f8be284d14f68f4d8e1d751e59289390b032c7beaab0
SSDEEP

3072:Soc2PvmVnYEhXdOcWAX8DZ/1/I/+9MeFIb:bmVnhKAGSVN

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1264	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcb80a7baae4d1e64b1f30f9252b5129_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	bcb80a7baae4d1e64b1f30f9252b5129_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1264	1848	bcb80a7baae4d1e64b1f30f9252b5129_JaffaCakes118.exe	30
PID 1848 wrote to memory of 1264	1848	bcb80a7baae4d1e64b1f30f9252b5129_JaffaCakes118.exe	30
PID 1848 wrote to memory of 1264	1848	bcb80a7baae4d1e64b1f30f9252b5129_JaffaCakes118.exe	30
PID 1848 wrote to memory of 1264	1848	bcb80a7baae4d1e64b1f30f9252b5129_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\bcb80a7baae4d1e64b1f30f9252b5129_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bcb80a7baae4d1e64b1f30f9252b5129_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Jlf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Jlf..bat

Filesize
238B

MD5
5da59b05fe562f15f4d975733ce91601

SHA1
fed3e84decff88efd9b9cdb0f4e5522ff367d94c

SHA256
c5af50f5a288e98316fa29bd06eb08d25a365b9ff45d0ed164cab6cfbc995e12

SHA512
e16e8ed3b252912f70f231d471585180a9667ad9ce1d9909fd8b0d6ceff2182de89854d501aaf33328653614d1b9488665994e960092e980e858ca0d66622b33

Download Submit
memory/1848-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1848-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1848-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1848-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1848-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1848-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1848-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download