6bef2afa2889f3d5f30a3a0d64c0e66cde080dffa3f888aa5f9588eaa2694d13

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d58e75cc04bd3bd64c692aeef1170779_JaffaCakes118.exe
Size

2.1MB
MD5

d58e75cc04bd3bd64c692aeef1170779
SHA1

ec42318efc3fe46c61b91e4cb7c263df8417b480
SHA256

6bef2afa2889f3d5f30a3a0d64c0e66cde080dffa3f888aa5f9588eaa2694d13
SHA512

447bd13dca87c72404ae4efebd782fc809a4c36d41e7ac21e9787bbd02421d04ee06636ad10fb427ccf80802ffd57071c099df9c0e57723993d273239202da91
SSDEEP

49152:LKHqQ6FsXLimtDlGNYRY8D3eN/iApEHrN4cgqtlivmfeN:LOosXLimRl+S3QjEHh4Mi+WN

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2740	d58e75cc04bd3bd64c692aeef1170779_JaffaCakes118.exe
2740	d58e75cc04bd3bd64c692aeef1170779_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	2740	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d58e75cc04bd3bd64c692aeef1170779_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2804	2740	d58e75cc04bd3bd64c692aeef1170779_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2804	2740	d58e75cc04bd3bd64c692aeef1170779_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2804	2740	d58e75cc04bd3bd64c692aeef1170779_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2804	2740	d58e75cc04bd3bd64c692aeef1170779_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d58e75cc04bd3bd64c692aeef1170779_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d58e75cc04bd3bd64c692aeef1170779_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 796
  2⤵
  - Program crash
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Dialog\sfx7.dll

Filesize
2.6MB

MD5
60ad31846ac04692b5a711a3b6f54b2c

SHA1
3de780e6ee694918e4e5779ac5667f43c707816a

SHA256
560f441e4505e53833da3e35c58b1dd54838499b826dde2e464a91544b35d7d0

SHA512
acc76609086df81f1d4121c37fdaea7ab10aa963c58a82a5673d1eb0e2888706a56b8195f8e018228c8f0e7c93a1e3025e671301eca0014d5081b99d6039185b

Download Submit
\Users\Admin\AppData\Local\Temp\nst742.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/2740-15-0x0000000002570000-0x000000000280A000-memory.dmp

Filesize
2.6MB

Download
memory/2740-18-0x0000000002570000-0x000000000280A000-memory.dmp

Filesize
2.6MB

Download