27228c21c361bb848fb33435b9a8c8f32e48e284f5919dec1a34c999bdc54582

Analysis

max time kernel
144s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
Size

14.2MB
MD5

e22e4582ca0520fc2dae75e26b35ce0b
SHA1

ea4ae8aa9a3462164f353258b5dfdf56a27a793f
SHA256

27228c21c361bb848fb33435b9a8c8f32e48e284f5919dec1a34c999bdc54582
SHA512

bb0a3af630dd49c27a1882d367ba2a9e7348c7d69dc2d1e830297341fff67f5f9fc7a63e6b305a997cc2e02ee379f47a5af834430628d47be7b992c1c11ca176
SSDEEP

49152:YJLc1kqIk5yFDgCRX6H4FPT0HB+ZGB/p43O7w9VFZnpu+2RJli7VS5C:Ya1p55YfRqH1xtUFNpuBRJli7VS5C

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\AntispywareBot System Startup.job	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\AntispywareBot Scheduled Scan.job	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
File created	C:\Windows\Tasks\AntispywareBot Scheduled Scan.job	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	2316	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
Token: SeRestorePrivilege	2316	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2316	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2316	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
2316	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
2316	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
2316	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\AntispywareBot Scheduled Scan.job

Filesize
592B

MD5
33cb91c8bd9f8cd558fb858e9f515426

SHA1
5b1447aa05c68b8f1339d0f7beb78d0b8688a986

SHA256
95f6373cc5f535832b84703755a6ba31620f4f4709850b8ccc2bbd02031608e0

SHA512
c502a884f43303427e4d1db67260a0279147274f84a3019297de5c6b590726448ae06e56e114e89a9e4de8e132c6d24f8db9e343d5d58f0a9192e56e13bfff8d

Download Submit
C:\Windows\Tasks\AntispywareBot Scheduled Scan.job

Filesize
592B

MD5
18d1ea8b01585b2ab9c07e0f34d2d83b

SHA1
d6f383fc72d4a46f4556d4770f25ee31734c7e67

SHA256
54ed752c3df7e36f73ae78b9b95684b9b96d56a8d252ca3aacdd6e88fcce958b

SHA512
f7fc0a8871be737017556ae3396bce93d3b238275a0b48db950fba58dc6b09a57fc14e3fc6e491c505a1834a1bfa4363e5f6fa025f5a0d967f6b9149f9230953

Download Submit