8870e49fd4e9925898dc17c02f9a64fd5a2d9da72de242ce61421bda8ebea44b

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe
Size

2.6MB
MD5

df7c8c52f24a2bcbc4efa9c3e7127129
SHA1

e6361519a89d969ed8a2f0b5b3a28f91c08ebd93
SHA256

8870e49fd4e9925898dc17c02f9a64fd5a2d9da72de242ce61421bda8ebea44b
SHA512

945bd3218d85e07f3a9528b3826ff2b8710d27d96e0b9847c715216bdf084bd7af5902e2d7ca4b4f225f1e83b0b236cc94be68640a5aba17d372cebb2903479a
SSDEEP

49152:43RsxCt3JB9UQA0hotW/aU/e6vrTV+rLFKAzstHraReOabHupA+lgWurbLG:43+C3JB9UQDYU2+2LFFQV4e7rOAsKPG

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3064	setup.exe

Loads dropped DLL 4 IoCs

pid	Process
2068	df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe
3064	setup.exe
3064	setup.exe
3064	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3064	2068	df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe	30
PID 2068 wrote to memory of 3064	2068	df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe	30
PID 2068 wrote to memory of 3064	2068	df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe	30
PID 2068 wrote to memory of 3064	2068	df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe	30
PID 2068 wrote to memory of 3064	2068	df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe	30
PID 2068 wrote to memory of 3064	2068	df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe	30
PID 2068 wrote to memory of 3064	2068	df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df7c8c52f24a2bcbc4efa9c3e7127129_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\exsp-win-6_0_1-ea32_2\setup.exe
  ".\exsp-win-6_0_1-ea32_2\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\WZSE0.TMP\exsp-win-6_0_1-ea32_2\setup.exe

Filesize
143KB

MD5
1eba70a7679b38c7b246c32ef4869735

SHA1
19777f340ecb558380033281ff091a2ebab8200c

SHA256
bad4dae9c9b36dcdd1d4ca283a1a4aa3ddd618c8367a365993dbab2fdaa232f3

SHA512
221b4e619773947e9899f941baafee949d2ef27fd640504b7d14960b1ef1f8c35c4ed27db491c32537d0063f2e2697f0b832258668214f939351c99dfc034cd7

Download Submit