5a273de4c854741f9a57ad0706f38c8c689a32dca677975514a949ec1e84db9d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bf2889be07fa79bc31f3caa1f7dcdd9b_JaffaCakes118.exe
Size

65KB
MD5

bf2889be07fa79bc31f3caa1f7dcdd9b
SHA1

605f0f86e6b5f07f359884d1498bf891df53f7e7
SHA256

5a273de4c854741f9a57ad0706f38c8c689a32dca677975514a949ec1e84db9d
SHA512

8f368281ebab0c2c3e8ba5e27446298abaca247cfd4ac5cb27506d37e470ef2d423ebe4622bdb58d82132db3816d5e985f0301b31f45f65e6e11d5170f84160e
SSDEEP

1536:R7fvTE6I2svgxaBDluXBcUbvzD77ew/Bslrw:RrTE6L+zBpzUbvzDOw/Wlrw

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
808	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf2889be07fa79bc31f3caa1f7dcdd9b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 808	1028	bf2889be07fa79bc31f3caa1f7dcdd9b_JaffaCakes118.exe	30
PID 1028 wrote to memory of 808	1028	bf2889be07fa79bc31f3caa1f7dcdd9b_JaffaCakes118.exe	30
PID 1028 wrote to memory of 808	1028	bf2889be07fa79bc31f3caa1f7dcdd9b_JaffaCakes118.exe	30
PID 1028 wrote to memory of 808	1028	bf2889be07fa79bc31f3caa1f7dcdd9b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\bf2889be07fa79bc31f3caa1f7dcdd9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf2889be07fa79bc31f3caa1f7dcdd9b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Hsb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Hsb..bat

Filesize
238B

MD5
74f2e2ad93ebbabe49d9b823a2f55dcf

SHA1
43cddc08ed56d427280112aafeffa2233c463a72

SHA256
a336d1b6839e3feab6f4131817e5305f215f86945cb4163c7260fefbfdc71f0b

SHA512
8aecbafbe93f6cde12f595f8b12b7474c8af69ab0cadc517112c83497319bc3362de642698de161c2ac30f37169d31e4209362c900fd99efea21173e3b99d97d

Download Submit
memory/1028-0-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1028-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1028-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1028-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1028-6-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download