9d751d9bbd37a00c83c6ee2d18ade2ab6199673f5ac9cbb2f67a12fa72297765

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1ad9776b86e2e52fb5dcc02d67ff6e5_JaffaCakes118.exe
Size

469KB
MD5

c1ad9776b86e2e52fb5dcc02d67ff6e5
SHA1

949dacc457df839273a3af1f7c82b018db0fc3e7
SHA256

9d751d9bbd37a00c83c6ee2d18ade2ab6199673f5ac9cbb2f67a12fa72297765
SHA512

4d0665378a56c7169dc7e84b0e6288c9a76ef7c3b687e25cb2f74b5464f5f0c5c66b0fdca06ae062b7a255b02f0efd3a7983506126913137f074a9ebbecdab71
SSDEEP

12288:TBYtPfKCCiAqO438FlcqToazQSDa9BslsxRp6C4dtIPC:etPyC5EcqToaW9qlsEC4dtw

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2900	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\c24f251b4d.dll	c1ad9776b86e2e52fb5dcc02d67ff6e5_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1ad9776b86e2e52fb5dcc02d67ff6e5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2900	2036	c1ad9776b86e2e52fb5dcc02d67ff6e5_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2900	2036	c1ad9776b86e2e52fb5dcc02d67ff6e5_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2900	2036	c1ad9776b86e2e52fb5dcc02d67ff6e5_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2900	2036	c1ad9776b86e2e52fb5dcc02d67ff6e5_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\c1ad9776b86e2e52fb5dcc02d67ff6e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c1ad9776b86e2e52fb5dcc02d67ff6e5_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$30689.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$30689.bat

Filesize
181B

MD5
2a3d1235989dcbffb0e23720e49ba8b6

SHA1
317704a44dfbfe25ba16fe69f54f4dc3b0a635ad

SHA256
0258ae8c38e4382870b46738c5c7c12e1da0555027cbf56c50b283da6b3206c2

SHA512
e3926751010b7c9ddd7344a934acdbd2460683b8043104d2697a9826ea273a29fc2b28ab42174e88547dc41480c312b041f5187eca14959a6d895b28dbbe49cb

Download Submit
memory/2036-0-0x0000000013140000-0x0000000013290000-memory.dmp

Filesize
1.3MB

Download
memory/2036-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2036-2-0x0000000013140000-0x0000000013290000-memory.dmp

Filesize
1.3MB

Download
memory/2036-3-0x0000000013140000-0x0000000013290000-memory.dmp

Filesize
1.3MB

Download
memory/2036-4-0x0000000013140000-0x0000000013290000-memory.dmp

Filesize
1.3MB

Download
memory/2036-12-0x0000000013140000-0x0000000013290000-memory.dmp

Filesize
1.3MB

Download