b9ec7bf263f8d784fd28131f619cd37131a016f812048754d9a661f1d164a76a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe
Size

165KB
MD5

ce97479fae7649fb30a458253c2447ee
SHA1

feca4b108a184e4237585130729b32e78f3c39de
SHA256

b9ec7bf263f8d784fd28131f619cd37131a016f812048754d9a661f1d164a76a
SHA512

e65cc7f715fa5b098b9c841b9ed985a5cd14f8ab8b262b6c1978bf5453ca554908bdafa078ecb1b70ce78bb754e73c464b81f9a980bd3e7e8f587a0ca9f456bc
SSDEEP

1536:5Ti19O1GvftOSn5FqosG3GpXwv3m3t7sCqUgeR5CzP:A1hvF1jsZXyQeUgeR5m

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2724	2520	ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2724	2520	ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2724	2520	ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2724	2520	ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2724	2520	ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2724	2520	ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2724	2520	ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce97479fae7649fb30a458253c2447ee_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Fkb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Fkb..bat

Filesize
238B

MD5
006ead579e844e565785965eedf344c1

SHA1
82fc12c7845cb30d26a91183fb676d5d4862b4c6

SHA256
fb0b17ee021c3c89b4ba3e3cb2c6feec3305a85457ed12052bfd733ba8ce8878

SHA512
c1f5eadd6b4c989d867f250c6baff5c2aacec14fc342b2408cdda2578cae2b81fa88147ddf10021bc051879131ab3363dc0232907390a317dbd1a57462539f1e

Download Submit
memory/2520-0-0x0000000000330000-0x0000000000355000-memory.dmp

Filesize
148KB

Download
memory/2520-1-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2520-3-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download