5aaad568fb2b6f05e72c9876ad04800571d9fd34a98d3651afcb0e3f429959a0

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
Size

96KB
MD5

ea8d99fab6d53e165f448a72c76645ff
SHA1

30ebbbef049064c5e2cee76bfa720229e0b66fa6
SHA256

5aaad568fb2b6f05e72c9876ad04800571d9fd34a98d3651afcb0e3f429959a0
SHA512

04458b59ff364a4f26b14e4142e4b16ddfbe3fe59b52882e9251efc9f00453d4caa7f8e62d44e48343708347941c9bb493635dd3db208f38b1e578e6eb7dd7d2
SSDEEP

1536:xowahuA0ipMAgciDeT2mFnToIf62MNFyxTX1Ab:xowahJ0y5iDeT2mtTBf6NNFyxTXGb

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1044	svmssc.exe

Executes dropped EXE 1 IoCs

pid	Process
1044	svmssc.exe

Loads dropped DLL 3 IoCs

pid	Process
1044	svmssc.exe
1044	svmssc.exe
1044	svmssc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Explorer	ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Explorer\svmssc.exe	ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Explorer\svmssc.exe	ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svmssc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2412	ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
1044	svmssc.exe

C:\Users\Admin\AppData\Local\Temp\ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2412

C:\Program Files\Microsoft Explorer\svmssc.exe
"C:\Program Files\Microsoft Explorer\svmssc.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Explorer\svmssc.exe

Filesize
13.1MB

MD5
f64d756ef5ca906b1db6f0d6c0b95525

SHA1
adc4d11ad334ff808e252dcf73a13517cd21445f

SHA256
3ab97c936ef07b77e21c7606b27fec2fc60fae62af0dfabc2e07234104922830

SHA512
d4ffd37008f4ffff0404aaeef660c1b531a1b26762318b7583c0bd38e9b5c77bda6fca6d5f1bfe8e5c43798254138a839fd3f4acaa2ce910217cfe883e363ea1

Download Submit
C:\SystemTemp

Filesize
84B

MD5
8cf67a47c6438c196e8affb87263f86f

SHA1
0c099be6a723166fce558e101070cef8d1576eac

SHA256
7a4f6c4ca1b0e3ab7d18195b179cb6ca99c6263648d783f099637f89c89b2f49

SHA512
29bdab2e80d4b3233bf387209374158af2217fff986d9cdea20d0e286fdae0a996dd650f80ef2b17cd4385a17962d965e7c7ef1da63ca7c4f5432cae7c88e1b2

Download Submit