6e0cc74073399f12e8e54ed1f3f273f1d6dff4d24283e66ab73fb8e29ddf6da3

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe
Size

76KB
MD5

df1b9cb67686c2b5cdda2dd70c2bf8ad
SHA1

9a9ec6819847f64573d82458348802026217892a
SHA256

6e0cc74073399f12e8e54ed1f3f273f1d6dff4d24283e66ab73fb8e29ddf6da3
SHA512

bad010ddf0c2114904a8686e8ae2f826be25b4e775593ec724d81c56feb50ac2078f96143dca972b4139106b7ca6d4186a8753ea9e84ffdd4fa772db88707dbb
SSDEEP

1536:1Rf1o2Ca7qiagSshdS0D6mJe7NeYRNgKJ+BCyNExQE7bvqc:1pj7EUbD6mJgeqgKJ+BCZvvqc

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2756	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1948	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe
1948	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fun_icon.ico	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2756	1948	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe	29
PID 1948 wrote to memory of 2756	1948	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe	29
PID 1948 wrote to memory of 2756	1948	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe	29
PID 1948 wrote to memory of 2756	1948	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe	29
PID 1948 wrote to memory of 2756	1948	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe	29
PID 1948 wrote to memory of 2756	1948	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe	29
PID 1948 wrote to memory of 2756	1948	df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df1b9cb67686c2b5cdda2dd70c2bf8ad_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c \DelUS.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DelUS.bat

Filesize
228B

MD5
59f92a914cb89a4facf24ddea6689491

SHA1
e31ffaf8ac004d2d836a05d66335b8ca118c0321

SHA256
c2352769f8b6bb1c020215b197c52910ea07e4ac36458bea21c4e7a17b62e64b

SHA512
317c434822abbc34cce353643c12650d9984e8e61c4548aa6bba5b3ea5f252439650e2bbc3060944c136838e47b6025883cae52aec5be0755350c40cb794ea1f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6E00.tmp\DLLWebCount.dll

Filesize
28KB

MD5
d825e4003d1697fd4bc45361e222746c

SHA1
e9d4b1073aac15d4dbb430471fcaea549e633d13

SHA256
c79e4be74eecf16f2f7f1d39724c938bf372e9568bb96fa4610926a57fe323f5

SHA512
7740a18cae5a42963c748a49ac6175482c93b34dce703a7cf24f5828ee6cdc19eb2669a634b64c2a4c861272f7e9b9e943455195a7cd6afcd8fa5586744eb86f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6E00.tmp\SelfDelete.dll

Filesize
24KB

MD5
7bf1bd7661385621c7908e36958f582e

SHA1
43242d7731c097e95fb96753c8262609ff929410

SHA256
c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e

SHA512
8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f

Download Submit