dfeed846f1550a7966c8ea06079fd6ab99e094eaed5d3b83ffff097d2d4021b6

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe
Size

201KB
MD5

d0cbd3cc267eeef814bb93f713d7d5da
SHA1

67ac446219b20ac3e6fd24e4acdb2f33e8aa2097
SHA256

dfeed846f1550a7966c8ea06079fd6ab99e094eaed5d3b83ffff097d2d4021b6
SHA512

65588742eebc73ac8ef6ccd6526017fbe524c6a27c641457c64a1755d1ae2ae0798193de7ad151d187f82efd0dc6a82da42903a60660d387aa602f1c4422e47a
SSDEEP

3072:kIatQqMlm/aMawNOud4W+DM8VC9vY7tSx2CYXNouBQkchxyUjoY:OtXMluZiqD9vYpSwCKodhkUjL

Score

6^/10

discovery

Malware Config

Signatures

Network Service Discovery 1 TTPs 9 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2252	cmd.exe
2556	cmd.exe
1264	ARP.EXE
2056	cmd.exe
2776	cmd.exe
2400	cmd.exe
1728	ARP.EXE
2716	cmd.exe
2624	ARP.EXE

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\temp1.txt	cmd.exe
File created	C:\Windows\SysWOW64\temp2.txt	cmd.exe
File opened for modification	C:\Windows\SysWOW64\temp2.txt	cmd.exe
File created	C:\Windows\SysWOW64\temp1.txt	cmd.exe
File created	C:\Windows\SysWOW64\temp2.txt	cmd.exe
File created	C:\Windows\SysWOW64\temp1.txt	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2556	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2556	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2556	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2556	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2400	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2400	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2400	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2400	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	32
PID 2556 wrote to memory of 1264	2556	cmd.exe	34
PID 2556 wrote to memory of 1264	2556	cmd.exe	34
PID 2556 wrote to memory of 1264	2556	cmd.exe	34
PID 2556 wrote to memory of 1264	2556	cmd.exe	34
PID 2400 wrote to memory of 1728	2400	cmd.exe	35
PID 2400 wrote to memory of 1728	2400	cmd.exe	35
PID 2400 wrote to memory of 1728	2400	cmd.exe	35
PID 2400 wrote to memory of 1728	2400	cmd.exe	35
PID 2508 wrote to memory of 2716	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	37
PID 2508 wrote to memory of 2716	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	37
PID 2508 wrote to memory of 2716	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	37
PID 2508 wrote to memory of 2716	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	37
PID 2716 wrote to memory of 2624	2716	cmd.exe	39
PID 2716 wrote to memory of 2624	2716	cmd.exe	39
PID 2716 wrote to memory of 2624	2716	cmd.exe	39
PID 2716 wrote to memory of 2624	2716	cmd.exe	39
PID 2508 wrote to memory of 2056	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	40
PID 2508 wrote to memory of 2056	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	40
PID 2508 wrote to memory of 2056	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	40
PID 2508 wrote to memory of 2056	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	40
PID 2508 wrote to memory of 2776	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	42
PID 2508 wrote to memory of 2776	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	42
PID 2508 wrote to memory of 2776	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	42
PID 2508 wrote to memory of 2776	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	42
PID 2508 wrote to memory of 2252	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	44
PID 2508 wrote to memory of 2252	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	44
PID 2508 wrote to memory of 2252	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	44
PID 2508 wrote to memory of 2252	2508	d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe	44

C:\Users\Admin\AppData\Local\Temp\d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0cbd3cc267eeef814bb93f713d7d5da_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c arp -a >%windir%\system32\temp1.txt
  2⤵
  - Network Service Discovery
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\ARP.EXE
    arp -a
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:1264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c arp -a >%windir%\system32\temp2.txt
  2⤵
  - Network Service Discovery
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\ARP.EXE
    arp -a
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c arp -a >%windir%\system32\temp2.txt
  2⤵
  - Network Service Discovery
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\ARP.EXE
    arp -a
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:2624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c arp -a >%windir%\system32\temp1.txt
  2⤵
  - Network Service Discovery
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c arp -a >%windir%\system32\temp2.txt
  2⤵
  - Network Service Discovery
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c arp -a >%windir%\system32\temp1.txt
  2⤵
  - Network Service Discovery
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\temp1.txt

Filesize
551B

MD5
88e5b39ab9711b6e3c27235ea05941f0

SHA1
5036157006953eec3d4ba9dd754ff9e5e9528d58

SHA256
41e20097c9a1344d75d5e685abc57b62abc6fb3c4071c518c04bbd932d235762

SHA512
67537c5302c4ee5febfdfed956b1104fc7ac146b07812fb381e8437ac631bb3105a6031fc7906be88058136d8154fc3c6ac329edb9f4f4e41718d07bb689e299

Download Submit
memory/2508-11-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download
memory/2508-5-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download
memory/2508-2-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download
memory/2508-1-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download
memory/2508-0-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/2508-12-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download
memory/2508-15-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download
memory/2508-16-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download
memory/2508-18-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download
memory/2508-19-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download
memory/2508-21-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download
memory/2508-22-0x0000000000400000-0x000000000046DEBA-memory.dmp

Filesize
439KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads