246448d7aa0e8842a21b59b02905e4ded1867398fd3a8042ceb2bc4dc31ee261

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea993d60e6c1ca6ee50d6d33b53ea642_JaffaCakes118.exe
Size

40KB
MD5

ea993d60e6c1ca6ee50d6d33b53ea642
SHA1

60a573ffc37e3c1e7afbee7f15bfc69f06a9b742
SHA256

246448d7aa0e8842a21b59b02905e4ded1867398fd3a8042ceb2bc4dc31ee261
SHA512

20d9d808a1a9f3bac48f0b872cad712907ab4eea524eb5a3fe3d98deb2871f16d7941c6db7d5db77fb28307d3f4906cc9006870e02efd3b29050be8451821358
SSDEEP

768:N9MWMs2iGNPbbj6+m1GOMREc607V1FRjs6iJIpJ+OWZhMDUHXbq:N9Mk2i4/6+CD0Djj5iJmY2We

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2264	ea993d60e6c1ca6ee50d6d33b53ea642_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zts2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ea993d60e6c1ca6ee50d6d33b53ea642_JaffaCakes118.exe"	ea993d60e6c1ca6ee50d6d33b53ea642_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea993d60e6c1ca6ee50d6d33b53ea642_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2264	ea993d60e6c1ca6ee50d6d33b53ea642_JaffaCakes118.exe
2264	ea993d60e6c1ca6ee50d6d33b53ea642_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2264	ea993d60e6c1ca6ee50d6d33b53ea642_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ea993d60e6c1ca6ee50d6d33b53ea642_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea993d60e6c1ca6ee50d6d33b53ea642_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\zts2.dll

Filesize
44KB

MD5
07d581dee20aa429f3752a55ac8204cc

SHA1
bbcdac251e3374490490d27a32ae918a6636c9dc

SHA256
13a20a759af1180c8d9b37065b54b13413a23955756396e0bd837f10b5850025

SHA512
1497a83664a91b1ca6dfdfe34d132e6a721dfb341fe74d91358c7695716a8bce8bb9c6fffbc8a4f51d62d4828b62fb87006d495fec145b2133d823f119477d67

Download Submit
memory/2264-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2264-1-0x0000000000020000-0x0000000000040000-memory.dmp

Filesize
128KB

Download
memory/2264-5-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download