5691f1a97feef769ef641d8aa0b4a8672570662504735bec31bdf38ce8332dc7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.exe
Size

740KB
MD5

c88208a26e1fa5b0ad0d573c7898abed
SHA1

ed201ac4be5a934eb04ddfd7f79fcb19e5a9f578
SHA256

5691f1a97feef769ef641d8aa0b4a8672570662504735bec31bdf38ce8332dc7
SHA512

30faa3278880b262bf463be828fa5f0c500d145865e026b627e6609e3851b94903016623187cbc05865618e518be865d38c737c5c7193e7985c04d5898eb441e
SSDEEP

12288:W2OFaMgDwvrIadBgY00tAo4oylwiEa0DUWgarjfy8kRimzct6sXpRrvMUix:W2OFRgDwvRgYTR4Oa0DbrmNRimz/ytqx

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2388	c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.tmp

Loads dropped DLL 1 IoCs

pid	Process
2028	c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2388	2028	c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2388	2028	c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2388	2028	c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2388	2028	c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\is-BVKFQ.tmp\c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BVKFQ.tmp\c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.tmp" /SL5="$400F2,718728,81408,C:\Users\Admin\AppData\Local\Temp\c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-BVKFQ.tmp\c88208a26e1fa5b0ad0d573c7898abed_JaffaCakes118.tmp

Filesize
56KB

MD5
32396a1493b16b58d4064e078e29aae4

SHA1
9994455388d74041a835c8ac3ea8ba287d92642c

SHA256
c56dbe1b720e614c4404940471e1a5148e4666ba77ef7a163b1a1c6a5a4c9d7e

SHA512
fa5b6588c85b0c33741e34c5329fc22503c4c7fa4823a92dedbcfe7722749ad65062f93442146ad923986c131ef51f61e176125caf1642a19f55ee490189698b

Download Submit
memory/2028-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2028-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2028-13-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2388-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2388-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2388-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download