d66166ce4de35cfd4c36c36bd6575ab774adc01230225c86ccc8c128999749a8

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe
Size

58KB
MD5

d27190b7134f619e4777bac5b946434b
SHA1

52c8036accaa6cc0316cedd360eccdcb5a5501b6
SHA256

d66166ce4de35cfd4c36c36bd6575ab774adc01230225c86ccc8c128999749a8
SHA512

20fe9aaa881618145bb4600020195673b16f302b862175affb1c979b75db515a47d6b154dc83511677c2e9396750e90a111df3efedcd1ebf78c0294599fa8e6b
SSDEEP

1536:aiquXs0GQls0YELrjRFrA23YAQ0mJx5zO1zCdi:aQs0pXvr9YAQRr1O1edi

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2900	cmd.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\PLUGINS\system2.jmp	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\PLUGINS\system2.jmp	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F}\InProcServer32\ = "C:\\Program Files\\Internet Explorer\\PLUGINS\\SystemKb.sys"	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F}\InProcServer32\ThreadingModel = "Apartment"	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F}	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F}\	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F}\InProcServer32	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2900	2164	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe	31
PID 2164 wrote to memory of 2900	2164	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe	31
PID 2164 wrote to memory of 2900	2164	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe	31
PID 2164 wrote to memory of 2900	2164	d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe_deleteme.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d27190b7134f619e4777bac5b946434b_JaffaCakes118.exe_deleteme.bat

Filesize
212B

MD5
8ed4576b62d1621ce59d2bc9e32258a8

SHA1
31883117208eb27dd6652d50f4eb63f572a528bc

SHA256
6aedb017939f534728b3f05ec8f07f916b428ae104df7ca8883334327530c39c

SHA512
13f7ae9a5d3f8559e171b4de1a1f39c10a22760467f400867fa21691bc3796b8250320fcba82f050426e6209a2924ef1eb91604da05b880964bee18b91f7367d

Download Submit
memory/2164-7-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download