67e6a9e10a09ff8a84d09cd22e417a109ffdf6619b81e209e8bfc73864b69d5e

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e1321ad61be86eee97edfc819d63d8a3_JaffaCakes118.exe
Size

21KB
MD5

e1321ad61be86eee97edfc819d63d8a3
SHA1

39c05fd3e6b59b743affb81bd968c317ec7454f0
SHA256

67e6a9e10a09ff8a84d09cd22e417a109ffdf6619b81e209e8bfc73864b69d5e
SHA512

2f4a0ccc7edce4a382379dbf3cb9e6fa10298b46be7c63ea43ebc9458d25f93c1c2b1e674af5439d4adfc8993fa56bcc19296f170cbbb6f72a9ddb802cc95501
SSDEEP

384:ZcdHgZN6K7GVt7Wc94klsbbSVjbBn5DdwrUcCWtvyXNxygO61O7DOUuawzQ:Z/ZPeth94klsbmTnLEVZF6Nxo8O7xuV

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\PA2ZEOMFLE35\SJ0NJJ486.exe	e1321ad61be86eee97edfc819d63d8a3_JaffaCakes118.exe
File opened for modification	C:\Program Files\PA2ZEOMFLE35\SJ0NJJ486.exe	e1321ad61be86eee97edfc819d63d8a3_JaffaCakes118.exe
File created	C:\Program Files\PA2ZEOMFLE35\28X1DB86.exe	e1321ad61be86eee97edfc819d63d8a3_JaffaCakes118.exe
File opened for modification	C:\Program Files\PA2ZEOMFLE35\28X1DB86.exe	e1321ad61be86eee97edfc819d63d8a3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1321ad61be86eee97edfc819d63d8a3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2364	e1321ad61be86eee97edfc819d63d8a3_JaffaCakes118.exe
2364	e1321ad61be86eee97edfc819d63d8a3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e1321ad61be86eee97edfc819d63d8a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e1321ad61be86eee97edfc819d63d8a3_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\PA2ZEOMFLE35\SJ0NJJ486.exe

Filesize
9.0MB

MD5
438a6a4b43d4d08f1f0378b35d6318b8

SHA1
c82c5ace8063942b6d820daa7fa634045b79cc4a

SHA256
9539d1c39e60f52f1bda06f8438c5085d79ced57b91debf6cbde3b070054a45a

SHA512
b4dbc86661c285c4d6857e7b27337c0b80827ad5f80321a7ae58bdf01958960e82fc4e33abfa7fcd9afa9286cd6c245b8f7bde5886c5a97114ac612b8b7bce95

Download Submit