09c9b0ea57aa3f2659ff5b8b157df0abc2fbfe54785d4534a8333b408157e5de

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe
Size

209KB
MD5

c16634b64410cad16fd0b371659331cb
SHA1

cea9110c3a6e19b307e1075cfa15767c687b898b
SHA256

09c9b0ea57aa3f2659ff5b8b157df0abc2fbfe54785d4534a8333b408157e5de
SHA512

3a2be51bd90ff120b79d825929ef030ef431d07356b2bb69f2e7433d5bc7e112f6deb1e4995b69b301395f053f474bf463731c2058cf418b439d020c34a51c0c
SSDEEP

6144:mBy/N9aWr8oLK3+LDbOWioP1BPGQJVCKuA:mBaNB3LJXyWiOf+WCq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2980	Tencent.exe

Loads dropped DLL 2 IoCs

pid	Process
2776	c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe
2776	c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Tencent.exe	c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Tencent.exe	Tencent.exe
File opened for modification	C:\Windows\SysWOW64\Tencent.exe	c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tencent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2776	c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe
2980	Tencent.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2980	2776	c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe	30
PID 2776 wrote to memory of 2980	2776	c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe	30
PID 2776 wrote to memory of 2980	2776	c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe	30
PID 2776 wrote to memory of 2980	2776	c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2928	2980	Tencent.exe	31
PID 2980 wrote to memory of 2928	2980	Tencent.exe	31
PID 2980 wrote to memory of 2928	2980	Tencent.exe	31
PID 2980 wrote to memory of 2928	2980	Tencent.exe	31

C:\Users\Admin\AppData\Local\Temp\c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c16634b64410cad16fd0b371659331cb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\Tencent.exe
  C:\Windows\system32\Tencent.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~ArpTest!.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~ArpTest!.bat

Filesize
131B

MD5
9b78d7b392419cacd90f48d44febbf7e

SHA1
0571a498b24e18832ca01ef776398d7a6eaecd34

SHA256
1781e7d433863376d820a9ea37fd6019b43c694db361de7502d695823a65fb63

SHA512
fd1dcbfc36efcda97d5ccb5068a61628724175260cddc77f8b2bb98987e5b8d19d7fc25ac0e43c3e98185a000f2d71807b611675e6e12a4a718fa18640457b8b

Download Submit
C:\Windows\SysWOW64\Tencent.exe

Filesize
209KB

MD5
c16634b64410cad16fd0b371659331cb

SHA1
cea9110c3a6e19b307e1075cfa15767c687b898b

SHA256
09c9b0ea57aa3f2659ff5b8b157df0abc2fbfe54785d4534a8333b408157e5de

SHA512
3a2be51bd90ff120b79d825929ef030ef431d07356b2bb69f2e7433d5bc7e112f6deb1e4995b69b301395f053f474bf463731c2058cf418b439d020c34a51c0c

Download Submit
memory/2776-20-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2980-18-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download