938d44be10097f59babeea2b2a388e8f71d663c4c543bb2bd599463f0a8b593b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe
Size

2.0MB
MD5

cfb15f3063108f87d77124e34fe742f6
SHA1

c8cca36ed81d9df4763b49e0fc9ec6ff66f8493c
SHA256

938d44be10097f59babeea2b2a388e8f71d663c4c543bb2bd599463f0a8b593b
SHA512

54d6618093e868a354562fdd50f9273c5de548302d59933c1d974b75345ee23033d1edd21ff827dac06e7a0774e8e0910f985bd1103a2bf630f766edbcc2c23b
SSDEEP

49152:vYYJQBqrxelsRDgq8sNU4tSETKpy6y0OuJTneRLzvNQbVbGbtg:f24clsRDgqPK4cAJlVuBneRLD8Vqbq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
336	QvodInit.exe

Loads dropped DLL 7 IoCs

pid	Process
1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe
1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe
1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe
336	QvodInit.exe
336	QvodInit.exe
336	QvodInit.exe
1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QvodInit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 336	1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe	28
PID 1716 wrote to memory of 336	1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe	28
PID 1716 wrote to memory of 336	1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe	28
PID 1716 wrote to memory of 336	1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe	28
PID 1716 wrote to memory of 336	1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe	28
PID 1716 wrote to memory of 336	1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe	28
PID 1716 wrote to memory of 336	1716	cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cfb15f3063108f87d77124e34fe742f6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\nso8384.tmp\QvodInit.exe
  "C:\Users\Admin\AppData\Local\Temp\nso8384.tmp\QvodInit.exe" WriteIni
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso8384.tmp\ioSpecial.ini

Filesize
710B

MD5
c3f78bca3ca93e020d37e4a5632d4212

SHA1
62e74567bc43fb94c8fd22ca6e34c2941a75195a

SHA256
8d23b72b96662f21f3880aeea0b8de2220b826093042e1bc9c9f67c13cd57a40

SHA512
46f48c416745f9fcc0ed43408a1674a055198b764900653f0c24f6757c74b16ec2a4ecec3f5221e8a991679fd3a7172941d0d4a9738bdbb2fa509ab724ea6a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso8384.tmp\qvod1.ini

Filesize
989B

MD5
a9bc1b1575c6962c6ff9b7190fdbe391

SHA1
88d28b25d3c5cbf4255fb2f1f1097f42bebd4370

SHA256
2849326892c2ca46bd097ea530f3de535a05ee9c6649b06aa8b4828a74ca580b

SHA512
7e9c523ed8fc3d9dc744c054ae74064795ccb8c340b10ff44fd82e85d361dd32783f31e055b1db7fac53e4cb085282f2e4b03b5376e96620ba235ee2968bb87d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso8384.tmp\qvod1.ini

Filesize
1KB

MD5
deb43745bd03e774bc62623757980163

SHA1
c72a147b067c9a87f8b0a33e446cf9b887423b2d

SHA256
a3945022a50f466626711f55c8b88502731627bcfab1532a827d752a15cbb429

SHA512
0a190e4e30a4e5e8df5e6a54e677c74503707bf1c933f5662daf33b2047fc8798ff088615dfd0ee30f30280af92c6cd7648f884e74e9e9df6b456c9b68348751

Download Submit
\Users\Admin\AppData\Local\Temp\nso8384.tmp\InstallOptions.dll

Filesize
14KB

MD5
0ee1d80ff67f5d5b1aebee2d50e38c9c

SHA1
250aea2e35e51fcd1492b817d1ebe8f467ac2565

SHA256
24215fa79a4e16fc77a103e0257d961e66023f4b89068b04d594463a138bbe1d

SHA512
e745a03b055324a84249abf2914f7cdd8e2e92213c3d51e5ddcc47bb051a525788972532893c0013d03fcc6a90ea8ca2df26d3af7939d08ece1307203de2e88c

Download Submit
\Users\Admin\AppData\Local\Temp\nso8384.tmp\LangDLL.dll

Filesize
5KB

MD5
29fc9b741c3eb0dc1f5bf9eddf316688

SHA1
f6e7f649d33e5cdbc4c09e331ce132144ed27140

SHA256
65133610bb3db9362b4e37d0dcdf3398eb376c7fba42daef9b73a2f2243cf4be

SHA512
ebb6ad70e18f333a3ed14bf2487647ede5ac565ecc763e7a138bf12068ebf53e6472feaaeeab5c66efbf3acd8d5ef795a4f4982b5eb160b723efe278354793f6

Download Submit
\Users\Admin\AppData\Local\Temp\nso8384.tmp\QvodInit.exe

Filesize
113KB

MD5
68356242edb61a53e3ecd44d96aca83b

SHA1
c518642d0aa312ed2d5d3dd871ae5d8849f03622

SHA256
61f936ef52c7c185dd6539ede1041dbd09b01b53443944a59d69e8dcb4e8f653

SHA512
127ae59caeddb13d16ea91d26ad146634ec6c7c4a0370b0c2b7a86ec8733e1dd4f6d2242a98b6e27b8b35870d1cf1253b56ca50c4ba681fce5be1a7f965494d8

Download Submit