Overview

overview

3

Static

static

3

bf0126089d...18.exe

windows7-x64

3

bf0126089d...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    24/08/2024, 16:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bf0126089df22f1069190a2ac7e414be_JaffaCakes118.exe

  • Size

    712KB

  • MD5

    bf0126089df22f1069190a2ac7e414be

  • SHA1

    27ecbe719394066f5126fd7dea3e66e3d887bbfd

  • SHA256

    45e1e99bcc891e5f7e88252f0b5633474d8d648b979b73459e7a733cbfe2d98e

  • SHA512

    33cb88e0c896f9d465ee2fa48dff0fa424c9f31e63c78af5b5203c242a844c0bfca34db3bbda99c1742fd4584ba24f97a2d6e2d5702feefafffbcbd89ef6efa5

  • SSDEEP

    12288:Zj+JbQIELvtMpbXlSyAh9B/lCl+j+JbQIELvtMpbXlSyAh9B/lCl:IJbQI0Fk5SheTJbQI0Fk5She

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf0126089df22f1069190a2ac7e414be_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bf0126089df22f1069190a2ac7e414be_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b4zdjhci.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2944
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4367.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4366.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES4367.tmp
    Filesize

    1KB

    MD5

    85645f3d83b745ea74ac6290691c6a2d

    SHA1

    a493affea0b8e176944fc74e72f5a1cc3a471762

    SHA256

    e93af7355347bbdc976923abbaac582e92f1ff75c5183ef4d2880844a4abf229

    SHA512

    793709aec84a9afa61e849e42c5df2b109a94b720af78e504948022c05b7929375f75d390d598e42759b338a58db986487c06bb91f26a09f2e347aaa03d5dcd2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\b4zdjhci.dll
    Filesize

    5KB

    MD5

    5b1cbc27f3123e978db9b40e9e1ede1c

    SHA1

    3f1a76fab5c72d1f043c8f938e1061f4a27f1edc

    SHA256

    16cda58739a6aa93b1f01f0460cdf04fc094efb314dd1086167e53d73102f7a2

    SHA512

    0311ac31546835191c360cd51557cbf4b1658dda020f6853d08f33f0c9a98f87e279e569ba89635d32f2726c5eb12abc784ce72b9ca17fd32900a89fd2ac56e3

    Download Submit

  • \??\c:\Users\Admin\AppData\Local\Temp\CSC4366.tmp
    Filesize

    652B

    MD5

    35b64d2b30fedc637e379e391714b42b

    SHA1

    a243e0c6e8dac8bc532d0667c5d3cfc30b4191e5

    SHA256

    0a821c197d3e24eed56d62313ce1dab947eca502f9abae36cdc3a27b2865d2f9

    SHA512

    6b08dd698eaf32885aa1e711bb08ffd23c34be6c4d2ca1f6157ac681d89dfbb04c0277f907d5666a969156e5d224bd2871412a8fa61239ee58e386e35fff9d7f

    Download Submit

  • \??\c:\Users\Admin\AppData\Local\Temp\b4zdjhci.0.cs
    Filesize

    4KB

    MD5

    6830431c6b49f72eaca4b2888a0ddaa9

    SHA1

    502083f68f991bfcfd771a7ba5bd508c2834591c

    SHA256

    ae57e8973a24563582d571743f0339d9347ffc82ed716d12a994694c2b673bf8

    SHA512

    939fa8cb2ca518904dea91b9612c53d833b9cf11e393fb376c1b0d00734e52b33708a6302e04bf15cb6a8e745475163766dec5a29ac265c914d0c286a170b35a

    Download Submit

  • \??\c:\Users\Admin\AppData\Local\Temp\b4zdjhci.cmdline
    Filesize

    206B

    MD5

    fc958ef9f2365c860d172e8ce00ef880

    SHA1

    26acfa91fbe873c92705fae649dbb28924764d64

    SHA256

    265a72ca13146ab73ee11a2f592f2fd752091947b681319e3be289968eac5023

    SHA512

    32f965a46962e7504fd212ae88f0639c8cc62264e5972cdc6a4e364a5ada174ec7b177adfb153e694c64427efa8ec98df4c6006b7f5528958717d50df3c0e27a

    Download Submit

  • memory/2640-0-0x0000000074621000-0x0000000074622000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2640-1-0x0000000074620000-0x0000000074BCB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2640-2-0x0000000074620000-0x0000000074BCB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2640-20-0x0000000074620000-0x0000000074BCB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2640-21-0x0000000074620000-0x0000000074BCB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2944-9-0x0000000074620000-0x0000000074BCB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2944-16-0x0000000074620000-0x0000000074BCB000-memory.dmp

    Filesize

    5.7MB

    Download