cae8680407a9377ea49eba966528e2948dd85154463a22097871355b15e73286

Analysis

max time kernel
147s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe
Size

66KB
MD5

c0d396c6e551f5c8b3ea038e188de392
SHA1

d7f212c415b5bc763ec5cb0f38257cd495099a37
SHA256

cae8680407a9377ea49eba966528e2948dd85154463a22097871355b15e73286
SHA512

56fafb5470532ac513519b2507b609aa446010f0698991a434955c0fa13dc1df2b3be1b7e77bfb4a000fafe71bb605753609fff8fa3f2bbbe68d8f3b354de537
SSDEEP

1536:qam8QFZkUL1ZJJU8HFrzK0Aw4dFaDDKxKR5O9qFj7j9H:qHZk4Zr9HRdJCa6Uj7JH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1924	Reader_sll.EXE
2812	Reader_sll.EXE
2636	Reader_sll.EXE
2672	Reader_sll.EXE
1600	Reader_sll.EXE
800	Reader_sll.EXE
1996	Reader_sll.EXE
2892	Reader_sll.EXE
1820	Reader_sll.EXE
1772	Reader_sll.EXE

Loads dropped DLL 20 IoCs

pid	Process
2140	c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe
2140	c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe
1924	Reader_sll.EXE
1924	Reader_sll.EXE
2812	Reader_sll.EXE
2812	Reader_sll.EXE
2636	Reader_sll.EXE
2636	Reader_sll.EXE
2672	Reader_sll.EXE
2672	Reader_sll.EXE
1600	Reader_sll.EXE
1600	Reader_sll.EXE
800	Reader_sll.EXE
800	Reader_sll.EXE
1996	Reader_sll.EXE
1996	Reader_sll.EXE
2892	Reader_sll.EXE
2892	Reader_sll.EXE
1820	Reader_sll.EXE
1820	Reader_sll.EXE

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File created	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File created	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File created	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File created	C:\Windows\SysWOW64\Reader_sll.EXE	c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File created	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File created	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File created	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File created	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File opened for modification	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File created	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE
File created	C:\Windows\SysWOW64\Reader_sll.EXE	Reader_sll.EXE

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sll.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sll.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sll.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sll.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sll.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sll.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sll.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sll.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sll.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1924	2140	c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe	30
PID 2140 wrote to memory of 1924	2140	c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe	30
PID 2140 wrote to memory of 1924	2140	c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe	30
PID 2140 wrote to memory of 1924	2140	c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2812	1924	Reader_sll.EXE	32
PID 1924 wrote to memory of 2812	1924	Reader_sll.EXE	32
PID 1924 wrote to memory of 2812	1924	Reader_sll.EXE	32
PID 1924 wrote to memory of 2812	1924	Reader_sll.EXE	32
PID 2812 wrote to memory of 2636	2812	Reader_sll.EXE	33
PID 2812 wrote to memory of 2636	2812	Reader_sll.EXE	33
PID 2812 wrote to memory of 2636	2812	Reader_sll.EXE	33
PID 2812 wrote to memory of 2636	2812	Reader_sll.EXE	33
PID 2636 wrote to memory of 2672	2636	Reader_sll.EXE	34
PID 2636 wrote to memory of 2672	2636	Reader_sll.EXE	34
PID 2636 wrote to memory of 2672	2636	Reader_sll.EXE	34
PID 2636 wrote to memory of 2672	2636	Reader_sll.EXE	34
PID 2672 wrote to memory of 1600	2672	Reader_sll.EXE	35
PID 2672 wrote to memory of 1600	2672	Reader_sll.EXE	35
PID 2672 wrote to memory of 1600	2672	Reader_sll.EXE	35
PID 2672 wrote to memory of 1600	2672	Reader_sll.EXE	35
PID 1600 wrote to memory of 800	1600	Reader_sll.EXE	36
PID 1600 wrote to memory of 800	1600	Reader_sll.EXE	36
PID 1600 wrote to memory of 800	1600	Reader_sll.EXE	36
PID 1600 wrote to memory of 800	1600	Reader_sll.EXE	36
PID 800 wrote to memory of 1996	800	Reader_sll.EXE	37
PID 800 wrote to memory of 1996	800	Reader_sll.EXE	37
PID 800 wrote to memory of 1996	800	Reader_sll.EXE	37
PID 800 wrote to memory of 1996	800	Reader_sll.EXE	37
PID 1996 wrote to memory of 2892	1996	Reader_sll.EXE	38
PID 1996 wrote to memory of 2892	1996	Reader_sll.EXE	38
PID 1996 wrote to memory of 2892	1996	Reader_sll.EXE	38
PID 1996 wrote to memory of 2892	1996	Reader_sll.EXE	38
PID 2892 wrote to memory of 1820	2892	Reader_sll.EXE	39
PID 2892 wrote to memory of 1820	2892	Reader_sll.EXE	39
PID 2892 wrote to memory of 1820	2892	Reader_sll.EXE	39
PID 2892 wrote to memory of 1820	2892	Reader_sll.EXE	39
PID 1820 wrote to memory of 1772	1820	Reader_sll.EXE	40
PID 1820 wrote to memory of 1772	1820	Reader_sll.EXE	40
PID 1820 wrote to memory of 1772	1820	Reader_sll.EXE	40
PID 1820 wrote to memory of 1772	1820	Reader_sll.EXE	40

C:\Users\Admin\AppData\Local\Temp\c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\Reader_sll.EXE
  C:\Windows\system32\Reader_sll.EXE 384 "C:\Users\Admin\AppData\Local\Temp\c0d396c6e551f5c8b3ea038e188de392_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\Reader_sll.EXE
    C:\Windows\system32\Reader_sll.EXE 464 "C:\Windows\SysWOW64\Reader_sll.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\SysWOW64\Reader_sll.EXE
      C:\Windows\system32\Reader_sll.EXE 468 "C:\Windows\SysWOW64\Reader_sll.EXE"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Windows\SysWOW64\Reader_sll.EXE
        
        C:\Windows\system32\Reader_sll.EXE 476 "C:\Windows\SysWOW64\Reader_sll.EXE"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2672
      - C:\Windows\SysWOW64\Reader_sll.EXE
        
        C:\Windows\system32\Reader_sll.EXE 472 "C:\Windows\SysWOW64\Reader_sll.EXE"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\Reader_sll.EXE
        
        C:\Windows\system32\Reader_sll.EXE 488 "C:\Windows\SysWOW64\Reader_sll.EXE"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:800
        
        C:\Windows\SysWOW64\Reader_sll.EXE
        
        C:\Windows\system32\Reader_sll.EXE 496 "C:\Windows\SysWOW64\Reader_sll.EXE"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\Reader_sll.EXE
        
        C:\Windows\system32\Reader_sll.EXE 480 "C:\Windows\SysWOW64\Reader_sll.EXE"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\SysWOW64\Reader_sll.EXE
        
        C:\Windows\system32\Reader_sll.EXE 484 "C:\Windows\SysWOW64\Reader_sll.EXE"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\SysWOW64\Reader_sll.EXE
        
        C:\Windows\system32\Reader_sll.EXE 492 "C:\Windows\SysWOW64\Reader_sll.EXE"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Reader_sll.EXE

Filesize
66KB

MD5
c0d396c6e551f5c8b3ea038e188de392

SHA1
d7f212c415b5bc763ec5cb0f38257cd495099a37

SHA256
cae8680407a9377ea49eba966528e2948dd85154463a22097871355b15e73286

SHA512
56fafb5470532ac513519b2507b609aa446010f0698991a434955c0fa13dc1df2b3be1b7e77bfb4a000fafe71bb605753609fff8fa3f2bbbe68d8f3b354de537

Download Submit
memory/800-43-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1600-38-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1772-65-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1820-62-0x0000000001F70000-0x0000000002017000-memory.dmp

Filesize
668KB

Download
memory/1820-59-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1924-14-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1996-48-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2140-13-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2140-0-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2140-10-0x0000000002720000-0x00000000027C7000-memory.dmp

Filesize
668KB

Download
memory/2636-27-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2636-25-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2672-31-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2672-33-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2812-18-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2812-23-0x00000000025A0000-0x0000000002647000-memory.dmp

Filesize
668KB

Download
memory/2812-20-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2892-54-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2892-52-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download