34d1e2b5e2417a797944c5b298f05be95982d5fec4d3ad9ee716bfb79579b14a

Analysis

max time kernel
140s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe
Size

567KB
MD5

daf8a5eda2bd48d5b80a1c2a7d285bad
SHA1

e6823a95fa855667c4a46e0f1e5959bf5299bc8e
SHA256

34d1e2b5e2417a797944c5b298f05be95982d5fec4d3ad9ee716bfb79579b14a
SHA512

d28cb66cde355fcc08e7fd9e12ecbd405abaa25001884471b399e53375bc5eb4511f37c045ccdaa7a3ec5b12c18321dec043ebc48e7ea3efd3a40a54dd6725ce
SSDEEP

12288:NJYIlIUr41owTtmHgYPW82ImgHTas8NrWr4YYARWP/yYaI1xCLo6yvS:NZlaTtmHJPWBImCTar84XH7x1s8ZK

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2392	setup.exe

Loads dropped DLL 4 IoCs

pid	Process
2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe
2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe
2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe
2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2392	2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 2392	2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 2392	2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 2392	2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 2392	2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 2392	2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 2392	2532	daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\daf8a5eda2bd48d5b80a1c2a7d285bad_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\banner.gif

Filesize
50KB

MD5
2bbfe6a0dfc9b9038b82d7183bf9c79b

SHA1
2a167441b84ab72dfc68696b0cfe5cc0209d3553

SHA256
a090f0a02ee737a47f5bcc7c8a7e30b0328f6448d05ae57101563a29693fdb28

SHA512
30c204243a5b8db8ecb6c8bdd32508129ed161ae0c515e677712845ea709d0f78f5093309f830eff5eaf7287fa9220565005e02e7fe7aa507241ac53f2ef9fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\grey_bar_710.gif

Filesize
1KB

MD5
8f37f672ca6923a9cc3b2d0f7007f6dd

SHA1
4be4c36139fbebdb0d5dc0593414aef850251a11

SHA256
93b5d88603d4aae07ea4d135b0b2de3efee8137221c8bcb64a28bee8e300dac7

SHA512
858f31a6be34f7f7ea849c5a805fb9b0f23cb5bdc2e710ed0bc72dfbe2ecd539ed21c3603038dd969232d4ce97e23f21855ab81a3cfac8a5d3640253811aabd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\lang.ini

Filesize
2KB

MD5
119b482883e355b1489628f33ee9ef88

SHA1
aff3ddbd68ff41d116af1b64558b354b8d1c3dca

SHA256
83cea594ac7bb6b1fc78bfce814b129189309882ff0fe760ca6bba103292d299

SHA512
c4eaed2b17d69189c9514646fdfeed4d4e8190f992f1c13375224fc00ac2a99b7850de6eaf0f2b3ebb35b251f74b6d859b1052a06b5900d0fbef25c84f6c0a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe

Filesize
835KB

MD5
36a25ebfbeefe809b692a48853ad0721

SHA1
1baf55b5a63d68be8b84c0f36555fd6207ee41dd

SHA256
85fdb70a131d0cc7fa4b5d713dd72c39802bdd0cf0b7bb6f2d574097a5bd3ac3

SHA512
574d992e87ff5deff615ca56e8ef63616d6d44cf121e68dd72e2ee7823e1a31f9a882261068aab1c7fcdf2f1dd6cc7aa653f7c6f9096893dbf43b41555c5c1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.ini

Filesize
6KB

MD5
a8b74a0f1630bb941c4038d4ec375142

SHA1
d4789db856aa792952cba39c0c7a0b7f673a6611

SHA256
a70d4860d7d2af34b6b085f1913b30707415704fb74ac4b1dc5e50f612ef9667

SHA512
e6ccdb090a211186f75e530721b858307007f9c944191297b7457059788d371907cab25e7664573be2ed695897e241eb2fc87c3c6a72a54a66029d9177b08771

Download Submit