3216ccb20bdd16443084eda94a1a2d3a3b9678865ee4d5bea7e11153b3596580

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa1d9d3277a03351677542768d44fa3_JaffaCakes118.exe
Size

122KB
MD5

eaa1d9d3277a03351677542768d44fa3
SHA1

81764a4d7a30f9439a58576d3e5e952b145b4661
SHA256

3216ccb20bdd16443084eda94a1a2d3a3b9678865ee4d5bea7e11153b3596580
SHA512

0387785b1284861f6f9e69f281d93c050ed76e5fe453672e59dcf9745e742484a103f58fd19967571bd8912c7e508a77234c672267062de5f99732b8a4195769
SSDEEP

3072:Tb/rAt4DgAeavbMlsa8NVVde1pm//rMtBpk1By+gQM:TbTMWUavWb8N7de1pm/A3pSBu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2664	rb.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rb.exe	eaa1d9d3277a03351677542768d44fa3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
852	2664	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eaa1d9d3277a03351677542768d44fa3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2972	eaa1d9d3277a03351677542768d44fa3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2664	2972	eaa1d9d3277a03351677542768d44fa3_JaffaCakes118.exe	30
PID 2972 wrote to memory of 2664	2972	eaa1d9d3277a03351677542768d44fa3_JaffaCakes118.exe	30
PID 2972 wrote to memory of 2664	2972	eaa1d9d3277a03351677542768d44fa3_JaffaCakes118.exe	30
PID 2972 wrote to memory of 2664	2972	eaa1d9d3277a03351677542768d44fa3_JaffaCakes118.exe	30
PID 2664 wrote to memory of 852	2664	rb.exe	31
PID 2664 wrote to memory of 852	2664	rb.exe	31
PID 2664 wrote to memory of 852	2664	rb.exe	31
PID 2664 wrote to memory of 852	2664	rb.exe	31

C:\Users\Admin\AppData\Local\Temp\eaa1d9d3277a03351677542768d44fa3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eaa1d9d3277a03351677542768d44fa3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\rb.exe
  "C:\Windows\rb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 36
    3⤵
    - Program crash
    PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\rb.exe

Filesize
107KB

MD5
1c5acb7dcae7001a8f2d7385a8386992

SHA1
50cf11cbe8743f40f015d97939a04e6dfae0526b

SHA256
021ff93a3b8532fe9430479897e37f6967f3b956a5f4160bd2b2f2802f4f1e6d

SHA512
92553c1a9742c8d9df6195b21099002f744ee7f8272b4e14785b60029fb6c6b3d5e2cb3b82a9b64225ebea3be4cad712e50d96156b9becb787324905add081b4

Download Submit
memory/2664-10-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2972-0-0x0000000000400000-0x0000000000421200-memory.dmp

Filesize
132KB

Download
memory/2972-9-0x0000000002A80000-0x0000000002AB9000-memory.dmp

Filesize
228KB

Download
memory/2972-8-0x0000000002A80000-0x0000000002AB9000-memory.dmp

Filesize
228KB

Download
memory/2972-11-0x0000000000400000-0x0000000000421200-memory.dmp

Filesize
132KB

Download
memory/2972-27-0x0000000002A80000-0x0000000002AB9000-memory.dmp

Filesize
228KB

Download