04ea4fdc5c97309e7e6a7b92ca77db62926f4ee57f8baf0061c4619b3acca31b

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe
Size

1.0MB
MD5

c1fbf166120f8315e11978977ad1457c
SHA1

59570e52429a29acc5bf8356bedc4c5a77b9839b
SHA256

04ea4fdc5c97309e7e6a7b92ca77db62926f4ee57f8baf0061c4619b3acca31b
SHA512

11e2749a2a2ddd736287dd37982bc12f9cec72136c65ed08607430688b026e1d3387652815fe858cac9e2ca61278742637bb2ebc2cdcd9c692acd6c93dabcb8f
SSDEEP

12288:hiRvLcJBxnYw2+9z3y0QqogzblEOGSEzUvzblE4wEQRUSEcfv44IdmIK0M4zkf:gSbxYTwziHqog+OP+ac34Lkf

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2972	c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\explorer.exe.local	c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe
File created	C:\Windows\ws2help.dll	c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe
File opened for modification	C:\Windows\ws2help.dll	c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe
File created	C:\Windows\Wplugin.dll	c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe
File opened for modification	C:\Windows\Wplugin.dll	c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe

Hijack Execution Flow: DLL Search Order Hijacking 1 TTPs
Possible initial access via DLL redirection search order hijacking.
defense_evasion

DLL Search Order Hijacking
T1574.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2972	c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c1fbf166120f8315e11978977ad1457c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Privilege Escalation

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Defense Evasion

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Intel\Logs\IntelGFX.log

Filesize
434B

MD5
e6d4e87a676ad42e73ab9ceb721d05d6

SHA1
3adcf8d574097b3954591d3d23c3215d8d0bb0da

SHA256
cbfd473c3ede1d526ad413670730e74e31c23287c9191a65529477e85ec8352b

SHA512
c23e55fa59955615ebe978888244be808f6462fb826bcd233b9174dc32dad15a554c6c686ccab512825326b3a42407aafd7496cd7efa908890a5d1a25794ae2f

Download Submit
C:\Intel\Logs\IntelGFX.log

Filesize
1016B

MD5
34fde243a61f7b808d83290e99a31dc6

SHA1
91a5228280d8f4d20b305e7851590773427f5ebd

SHA256
089f494df67d9ba4397b48c0f885bf4f03b1d70c0da35edd894d1eeaf4e4df03

SHA512
a17d411f0ec7054b3c5ffc5d6a0879ddb71de33d0db8c3c9c136796ecff6cf96a5c66dbe1744679f23051dbc318d61512a5c2f71d9aef10b7782071803ed7689

Download Submit
\Users\Admin\AppData\Roaming\Wplugin.dll

Filesize
108KB

MD5
8847a8302dacc1d6fca61f125c8fe8e0

SHA1
f399142bbf03660bee1df555ebbf3acc8f658cf0

SHA256
9c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943

SHA512
2b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f

Download Submit