8be17a116f29da3d4214d54cf0868898863b9cd74a27502a5a4fd7c936f6f77a

Analysis

max time kernel
147s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe
Size

91KB
MD5

ddbbc1adfb89a7efc303a83a22cde0a5
SHA1

9dec902f5356431ee6ec19b2f6687a3d2f38cd7c
SHA256

8be17a116f29da3d4214d54cf0868898863b9cd74a27502a5a4fd7c936f6f77a
SHA512

6e94e6d232316285064f806e00a94541aef8ff3c178a4f3bd2d7938605af0aa79092f4de4ed3ca00bbfc1e648935e6e533cb65cdf3e002d7f2d647b9803a628a
SSDEEP

1536:HI1nwAvHt2VRhwsWCZtmVncyv+yNA9p/bxWGKaYrBXB5DoSLHxATAiF6Nnlh8:HJAvHtqhXv0Dv+yu9hxWQMXB5USd2vFx

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2700	svchosts.exe
2672	svchosts.exe
2608	svchosts.exe
2424	svchosts.exe
2732	svchosts.exe
2876	svchosts.exe
2076	svchosts.exe
1424	svchosts.exe
2228	svchosts.exe
1244	svchosts.exe

Loads dropped DLL 20 IoCs

pid	Process
2740	ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe
2740	ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe
2700	svchosts.exe
2700	svchosts.exe
2672	svchosts.exe
2672	svchosts.exe
2608	svchosts.exe
2608	svchosts.exe
2424	svchosts.exe
2424	svchosts.exe
2732	svchosts.exe
2732	svchosts.exe
2876	svchosts.exe
2876	svchosts.exe
2076	svchosts.exe
2076	svchosts.exe
1424	svchosts.exe
1424	svchosts.exe
2228	svchosts.exe
2228	svchosts.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe
File created	C:\Windows\SysWOW64\svchosts.exe	svchosts.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2700	2740	ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2700	2740	ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2700	2740	ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2700	2740	ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2672	2700	svchosts.exe	31
PID 2700 wrote to memory of 2672	2700	svchosts.exe	31
PID 2700 wrote to memory of 2672	2700	svchosts.exe	31
PID 2700 wrote to memory of 2672	2700	svchosts.exe	31
PID 2672 wrote to memory of 2608	2672	svchosts.exe	32
PID 2672 wrote to memory of 2608	2672	svchosts.exe	32
PID 2672 wrote to memory of 2608	2672	svchosts.exe	32
PID 2672 wrote to memory of 2608	2672	svchosts.exe	32
PID 2608 wrote to memory of 2424	2608	svchosts.exe	33
PID 2608 wrote to memory of 2424	2608	svchosts.exe	33
PID 2608 wrote to memory of 2424	2608	svchosts.exe	33
PID 2608 wrote to memory of 2424	2608	svchosts.exe	33
PID 2424 wrote to memory of 2732	2424	svchosts.exe	34
PID 2424 wrote to memory of 2732	2424	svchosts.exe	34
PID 2424 wrote to memory of 2732	2424	svchosts.exe	34
PID 2424 wrote to memory of 2732	2424	svchosts.exe	34
PID 2732 wrote to memory of 2876	2732	svchosts.exe	35
PID 2732 wrote to memory of 2876	2732	svchosts.exe	35
PID 2732 wrote to memory of 2876	2732	svchosts.exe	35
PID 2732 wrote to memory of 2876	2732	svchosts.exe	35
PID 2876 wrote to memory of 2076	2876	svchosts.exe	36
PID 2876 wrote to memory of 2076	2876	svchosts.exe	36
PID 2876 wrote to memory of 2076	2876	svchosts.exe	36
PID 2876 wrote to memory of 2076	2876	svchosts.exe	36
PID 2076 wrote to memory of 1424	2076	svchosts.exe	37
PID 2076 wrote to memory of 1424	2076	svchosts.exe	37
PID 2076 wrote to memory of 1424	2076	svchosts.exe	37
PID 2076 wrote to memory of 1424	2076	svchosts.exe	37
PID 1424 wrote to memory of 2228	1424	svchosts.exe	38
PID 1424 wrote to memory of 2228	1424	svchosts.exe	38
PID 1424 wrote to memory of 2228	1424	svchosts.exe	38
PID 1424 wrote to memory of 2228	1424	svchosts.exe	38
PID 2228 wrote to memory of 1244	2228	svchosts.exe	39
PID 2228 wrote to memory of 1244	2228	svchosts.exe	39
PID 2228 wrote to memory of 1244	2228	svchosts.exe	39
PID 2228 wrote to memory of 1244	2228	svchosts.exe	39

C:\Users\Admin\AppData\Local\Temp\ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\svchosts.exe
  C:\Windows\system32\svchosts.exe 496 "C:\Users\Admin\AppData\Local\Temp\ddbbc1adfb89a7efc303a83a22cde0a5_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\svchosts.exe
    C:\Windows\system32\svchosts.exe 532 "C:\Windows\SysWOW64\svchosts.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\SysWOW64\svchosts.exe
      C:\Windows\system32\svchosts.exe 548 "C:\Windows\SysWOW64\svchosts.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Windows\SysWOW64\svchosts.exe
        
        C:\Windows\system32\svchosts.exe 528 "C:\Windows\SysWOW64\svchosts.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2424
      - C:\Windows\SysWOW64\svchosts.exe
        
        C:\Windows\system32\svchosts.exe 536 "C:\Windows\SysWOW64\svchosts.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\svchosts.exe
        
        C:\Windows\system32\svchosts.exe 556 "C:\Windows\SysWOW64\svchosts.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\SysWOW64\svchosts.exe
        
        C:\Windows\system32\svchosts.exe 540 "C:\Windows\SysWOW64\svchosts.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\svchosts.exe
        
        C:\Windows\system32\svchosts.exe 544 "C:\Windows\SysWOW64\svchosts.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\svchosts.exe
        
        C:\Windows\system32\svchosts.exe 552 "C:\Windows\SysWOW64\svchosts.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SysWOW64\svchosts.exe
        
        C:\Windows\system32\svchosts.exe 560 "C:\Windows\SysWOW64\svchosts.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\svchosts.exe

Filesize
91KB

MD5
ddbbc1adfb89a7efc303a83a22cde0a5

SHA1
9dec902f5356431ee6ec19b2f6687a3d2f38cd7c

SHA256
8be17a116f29da3d4214d54cf0868898863b9cd74a27502a5a4fd7c936f6f77a

SHA512
6e94e6d232316285064f806e00a94541aef8ff3c178a4f3bd2d7938605af0aa79092f4de4ed3ca00bbfc1e648935e6e533cb65cdf3e002d7f2d647b9803a628a

Download Submit
memory/1244-62-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/1424-51-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2076-45-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2076-49-0x0000000002480000-0x000000000251C000-memory.dmp

Filesize
624KB

Download
memory/2076-48-0x0000000002480000-0x000000000251C000-memory.dmp

Filesize
624KB

Download
memory/2228-60-0x0000000001D20000-0x0000000001DBC000-memory.dmp

Filesize
624KB

Download
memory/2228-58-0x0000000001D20000-0x0000000001DBC000-memory.dmp

Filesize
624KB

Download
memory/2228-56-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2228-55-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2424-31-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2608-26-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2608-29-0x0000000002620000-0x00000000026BC000-memory.dmp

Filesize
624KB

Download
memory/2672-22-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2700-19-0x00000000026E0000-0x000000000277C000-memory.dmp

Filesize
624KB

Download
memory/2700-20-0x00000000026E0000-0x000000000277C000-memory.dmp

Filesize
624KB

Download
memory/2700-16-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2700-13-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2732-38-0x0000000001FF0000-0x000000000208C000-memory.dmp

Filesize
624KB

Download
memory/2732-39-0x0000000001FF0000-0x000000000208C000-memory.dmp

Filesize
624KB

Download
memory/2732-35-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2740-0-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2740-15-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download
memory/2740-10-0x0000000002530000-0x00000000025CC000-memory.dmp

Filesize
624KB

Download
memory/2740-6-0x0000000002530000-0x00000000025CC000-memory.dmp

Filesize
624KB

Download
memory/2876-41-0x0000000000400000-0x000000000049B780-memory.dmp

Filesize
621KB

Download