171fc4207b64faeb0618651c42fc304b53e3365e8b9266bfb9a6c1f4c952f5c7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6f3cb9bf395676756867c3c113d65aa_JaffaCakes118.exe
Size

212KB
MD5

d6f3cb9bf395676756867c3c113d65aa
SHA1

d2615023f3117fa41448e02eb1d7622c2dbeeeb3
SHA256

171fc4207b64faeb0618651c42fc304b53e3365e8b9266bfb9a6c1f4c952f5c7
SHA512

2f5dc2f827cea90c62a1d5220c95b2ef0d71b5b23dd8429c2ea71a32eb3beece67936cf539c5a34f6eb32b33996ee0695862d610a1083f66ba3e4043a130b7d3
SSDEEP

6144:We34y2pbTh+3pwLpAKKi8A//t4V1TLAo/o5b77ClFxQ:kvh+3KaltAnIhLB/m4Q

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2864	dlmgn.exe

Loads dropped DLL 1 IoCs

pid	Process
2716	d6f3cb9bf395676756867c3c113d65aa_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6f3cb9bf395676756867c3c113d65aa_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2864	dlmgn.exe
2864	dlmgn.exe
2864	dlmgn.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	dlmgn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2864	dlmgn.exe
2864	dlmgn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2864	2716	d6f3cb9bf395676756867c3c113d65aa_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2864	2716	d6f3cb9bf395676756867c3c113d65aa_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2864	2716	d6f3cb9bf395676756867c3c113d65aa_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2864	2716	d6f3cb9bf395676756867c3c113d65aa_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d6f3cb9bf395676756867c3c113d65aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d6f3cb9bf395676756867c3c113d65aa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\nst7688.tmp\dlmgn.exe
  C:\Users\Admin\AppData\Local\Temp\nst7688.tmp\dlmgn.exe "C:\Users\Admin\AppData\Local\Temp\d6f3cb9bf395676756867c3c113d65aa_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabBEBF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF6E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst7688.tmp\dlmgn.exe.config

Filesize
291B

MD5
7f9dda91f4aada0a673991e0a0d04b7a

SHA1
9736abd42acff7db5b0551294f533dcb1a1a5cf7

SHA256
b50e8b399b9560285ec9572c1490613cdbc4d5ad4ac29db955c45c10a28b04fc

SHA512
d9de3d0204ae178972259cec7882845f654dad9082a20aa629c47b93f0e9d71e568e901d20c68e14a48ddd29f72b857b8509c401a16c65d8f37b5485ae0cdb1e

Download Submit
\Users\Admin\AppData\Local\Temp\nst7688.tmp\dlmgn.exe

Filesize
369KB

MD5
3c8fcdd5824e8194f999e9ca50c3c751

SHA1
89ffa620df2c41641dcb4af815c0e381dcd2a4da

SHA256
9c362ee61694e130bd904bfcf7c32c33851ab106e5b0121f800c31e42636d870

SHA512
dc6b2ceb1b2847f53f866a154a6ace2faf3782ce74df4ed3920fbc73994796d0518bc1ef06648d4800e1ace8462d1af11cdb8b5ecbbf2d5d3389e2a439764f2d

Download Submit
memory/2864-6-0x000007FEF5FBE000-0x000007FEF5FBF000-memory.dmp

Filesize
4KB

Download
memory/2864-8-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download
memory/2864-24-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download
memory/2864-25-0x000007FEF5FBE000-0x000007FEF5FBF000-memory.dmp

Filesize
4KB

Download
memory/2864-62-0x0000000000520000-0x0000000000530000-memory.dmp

Filesize
64KB

Download
memory/2864-63-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download
memory/2864-64-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download
memory/2864-65-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download