6abad190533d80bfd8ac9240a46dbaf860e45aca15929cbf22fd2d92d5e621a0

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe
Size

701KB
MD5

cfa04e1b42f8916d2bd99675b17d5831
SHA1

efd9b7c3cabc8c4d177200c3fd4c21c9c3f446c0
SHA256

6abad190533d80bfd8ac9240a46dbaf860e45aca15929cbf22fd2d92d5e621a0
SHA512

ffb6aee5497c2ac0e31c7c121576607f53072249facd59c961074fef064133947e77cbb114d947a4264166e1c1b88ef169794ac4e0a3df78d1d5e50abd64e2dc
SSDEEP

12288:eGcoX5LFf/LY80pUX4DwJ2+B05OEkz4+WqEe4/sVO:AabfTgk4E4+O4lz4Fe

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe	cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2776	scvhost.exe

Loads dropped DLL 4 IoCs

pid	Process
2240	cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe
2240	cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe
2240	cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe
2240	cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2776	2240	cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2776	2240	cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2776	2240	cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2776	2240	cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cfa04e1b42f8916d2bd99675b17d5831_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe

Filesize
557KB

MD5
33d275ea4fb74ed4004164bb69b73869

SHA1
cd5d4ccceb3ca406e9bc8022ef8df41dd56e1981

SHA256
a82bb5b963a543f7bcd7586af89fe0b0bbf4c6e1d9da8cf99879928e3b548c5c

SHA512
5198f1e4fb3484c68a443c6871aa2478452ea39fe148837f72b0cd566d1d00137447325ad9daa0f365f92cc04f297d4c4ebef8930483f68f4ed3ab79bd3e0284

Download Submit
memory/2240-20-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2776-21-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2776-24-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2776-23-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-25-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-26-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-27-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-28-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-29-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-30-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-31-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-32-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-33-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-34-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-35-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-36-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2776-37-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download