6bf8a9551ae84d5b7b33df218682281f4cdf1d46a91718cd8e481daff029d80a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
Size 109KB
Sample240825-nwl3vssepd
SHA256 6bf8a9551ae84d5b7b33df218682281f4cdf1d46a91718cd8e481daff029d80a
MD5 c0ac7bc7d8e913ce6721472a85db8081
SHA1 e5da493cb140e33b06bc7c684348a96f7944b19f
SHA512 c3945910f356d2af281722a5a52992e710c054664f5dfd006a1af8842bd8d6dd46a04b8ff120d83ede986aab3ea9af86c0e6255396c0900d8f03a3d98dd9af37
SSDEEP 3072:Vc1ku8HsnRTfv9Z01N6KVO4OE4vsBfi5X8eXHK:Vc6u5RTfvIPpVlOE4W
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1640	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2272	EXPL0RER.EXE

Loads dropped DLL 2 IoCs

pid	Process
2112	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
2112	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXE	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SysModule32.DLL	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\MFCD3O.DLL	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File opened for modification	C:\Windows\MFCD3O.DLL	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPL0RER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2272	2112	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2272	2112	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2272	2112	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2272	2112	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	39
PID 2112 wrote to memory of 1640	2112	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	40
PID 2112 wrote to memory of 1640	2112	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	40
PID 2112 wrote to memory of 1640	2112	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	40
PID 2112 wrote to memory of 1640	2112	c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe	40

C:\Users\Admin\AppData\Local\Temp\c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c0ac7bc7d8e913ce6721472a85db8081_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\EXPL0RER.EXE
  C:\Windows\system32\EXPL0RER.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$336699.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$336699.bat

Path C:\Users\Admin\AppData\Local\Temp\$$336699.bat
Size 259B
SHA256 be3316fbcf23501a2d09e9adcd3af1b16cea17eba0fc7464104ed9a59919f748
MD5 95e376be0acf882708d8b53659927870
SHA1 1b4d4157c76b510e6983c49b5bcdb08161c4a1b4
SHA512 f65544f20e25df60a6b79b7c9d34c43f7404570f37baacdedfb9fd15d645739d7ad20f195a3cfc824d9dbcf24d5a577a5c04df56126fe2b6d20dd0d0bc00b04d
MD5 SHA1 SHA512

Submit Download

EXPL0RER.EXE

Path C:\Windows\SysWOW64\EXPL0RER.EXE
Size 109KB
SHA256 6bf8a9551ae84d5b7b33df218682281f4cdf1d46a91718cd8e481daff029d80a
MD5 c0ac7bc7d8e913ce6721472a85db8081
SHA1 e5da493cb140e33b06bc7c684348a96f7944b19f
SHA512 c3945910f356d2af281722a5a52992e710c054664f5dfd006a1af8842bd8d6dd46a04b8ff120d83ede986aab3ea9af86c0e6255396c0900d8f03a3d98dd9af37
SSDEEP 3072:Vc1ku8HsnRTfv9Z01N6KVO4OE4vsBfi5X8eXHK:Vc6u5RTfvIPpVlOE4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysModule32.DLL

Path C:\Windows\SysWOW64\SysModule32.DLL
Size 49KB
SHA256 e9fc263ae7655fd93709ccc31fb25259c6c3de4b50836d7525b75a90ad357a7f
MD5 708e65cea6091b7277e8260d3c4255d4
SHA1 5af3d16dbd7a8dc49672215ec7a94eef7b03a46e
SHA512 8f71f7b633a2efd652e16c85074f406a16d86bc9c9e2dcef10bdcff51a0a4a48337cf7da59b1e622951f14cdb36eae87d3b47d7c28234981c04e757a2e9908a4
SSDEEP 1536:bmFqAF1sa6KczkDVP2DfsOEl4aMsBfXS5X8:b01N6KVO4OE4vsBfi5X8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2112-13-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2112-19-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2112-14-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2112-15-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2112-16-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2112-17-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2112-18-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2112-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2112-11-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2112-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2112-41-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2272-43-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2272-44-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2272-45-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2272-46-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads