8dbb039d4fde97df73cb9abf36b727bfdb309c87187f28dbbf37079afeb94ae0

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
Size

155KB
MD5

d60d36fbe79291d3cfc6f64d49c215b8
SHA1

6712cffa4307ef6e258cffa051009f29a097025f
SHA256

8dbb039d4fde97df73cb9abf36b727bfdb309c87187f28dbbf37079afeb94ae0
SHA512

802792018182a9b7a50b790d3e11d45156ba520deb6aea4b13303961c6645843110c824dfe3af991d372ec5e477c606e863b0c416cc4231e686e24e5c1e977d0
SSDEEP

1536:vWGX5LJVgyn8YBCDJ1LM4SPMu/yuOEejohZ1rlvRfqq1LKIainWSPGEaAv2P8tJd:vWgtC3VsMH81rr/1L7JGEaAvw8PSI

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Systen.dll	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Systen.dll	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\fjedjbhia.dll	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
File created	C:\Windows\918.dat	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
File created	C:\Windows\fjeeccdga.bat	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1620	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
Token: SeDebugPrivilege	1620	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 432	1620	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	5
PID 1620 wrote to memory of 1860	1620	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	30
PID 1620 wrote to memory of 1860	1620	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	30
PID 1620 wrote to memory of 1860	1620	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	30
PID 1620 wrote to memory of 1860	1620	d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe	30

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Users\Admin\AppData\Local\Temp\d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d60d36fbe79291d3cfc6f64d49c215b8_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\fjeeccdga.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Systen.dll

Filesize
145KB

MD5
fe2287bede17b4cc972241efa80860f2

SHA1
cec50935c8e76172b67c041786b66098c0340b4d

SHA256
e6b0201308a63a2dd7b96a18afda3df95ea7807adb3c10b4305aedfa2a96c1e1

SHA512
a72bffc72401ca88f09b7ec71d0286a0cfe96eba288e5dbcf38c8a40cf99e2b07c5fc6a1787300e60626bdf2e3fd03c962b4ddb74185c6d33715beaac5f068dd

Download Submit
C:\Windows\fjeeccdga.bat

Filesize
99B

MD5
b9f5589702645bd3eacff827afaa4f26

SHA1
df170b7d65f5404f7a9510bc3a0f9e87b22ca4ed

SHA256
d1fb35b224f7d49f604edd85cea64baae68639e774e9ffb0a1d8cfefee89b351

SHA512
fce88b47d1e6e08d50ff50b405eb0f9be2b047427549d911ea9df26172d1bc3b2fd031a4c4e1db8227a28d3a747f8b18c1e2cedee1e5e0c44e74f6fb635a849a

Download Submit
memory/432-6-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1620-1-0x00000000001E0000-0x0000000000209000-memory.dmp

Filesize
164KB

Download
memory/1620-15-0x0000000000010000-0x000000000003E000-memory.dmp

Filesize
184KB

Download
memory/1620-16-0x00000000001E0000-0x0000000000209000-memory.dmp

Filesize
164KB

Download