002db362e50ad1a19af695372c2511cdb2de3fd61c23c5e18901be8fd90a0efd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac37f1765369ed6834dfc82d7ca8780_JaffaCakes118.exe
Size

233KB
MD5

eac37f1765369ed6834dfc82d7ca8780
SHA1

9d8e8dadf568c05c336bebfc09b177d8ffc95ce8
SHA256

002db362e50ad1a19af695372c2511cdb2de3fd61c23c5e18901be8fd90a0efd
SHA512

6d91edaf662fc310f4d6e4e206c6ddc48e57fd3fe43a7c71abe308b12dbe1d51afd4950282dfd611394f2f50f223271285ec69dd7236805f15e2641b94437a78
SSDEEP

6144:4xyMeM8tKmy/q7RglyFlqsGnK48uGSiU4pl:4xyMehti/8R7lJEGSiU4H

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2352	eac37f1765369ed6834dfc82d7ca8780_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eac37f1765369ed6834dfc82d7ca8780_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1312	2352	eac37f1765369ed6834dfc82d7ca8780_JaffaCakes118.exe	30
PID 2352 wrote to memory of 1312	2352	eac37f1765369ed6834dfc82d7ca8780_JaffaCakes118.exe	30
PID 2352 wrote to memory of 1312	2352	eac37f1765369ed6834dfc82d7ca8780_JaffaCakes118.exe	30
PID 2352 wrote to memory of 1312	2352	eac37f1765369ed6834dfc82d7ca8780_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\eac37f1765369ed6834dfc82d7ca8780_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eac37f1765369ed6834dfc82d7ca8780_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\0e1cdf02-bedb-4504-aa63-1394db655182\start.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0e1cdf02-bedb-4504-aa63-1394db655182\loader.gif

Filesize
1KB

MD5
e88ebd85dd56110ac6ea93fe0922988e

SHA1
684a31d864d33ff736234c41ac4e8d2c7f90d5ae

SHA256
379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

SHA512
211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\0e1cdf02-bedb-4504-aa63-1394db655182\start.hta

Filesize
1KB

MD5
1e0053dfeeecf4c16284d6dad4fd86f4

SHA1
fe4ca30de707e1f77e5e258f62007f82633b6773

SHA256
e2d32f98e234880b02f55506b75e13ec992ed53f39c35c19bef070b081eea3bb

SHA512
5fb547735e5516f95ecb68bc5f862c7af963fe415a3aee9f2e4671473d1dbe36c65e2e2760900b96a81f5d27cb49b6f68c2f10d310ede93963ad78eea691e76b

Download Submit
\Users\Admin\AppData\Local\Temp\0e1cdf02-bedb-4504-aa63-1394db655182\helper.dll

Filesize
122KB

MD5
47cb6d4a317540d0fbbdbf813bd24d7f

SHA1
fdf0ca931b67bda1c62c157357dfb0729b9e9ee8

SHA256
d376d8192ece1fe69a9ec5a77fb512c41a3fe55417478635d7fe2d874e0ed49e

SHA512
1fb63ab4d7fb8fcc26f4c9333bbfa893b1253606035df6be8bfa2188e363372999f517bf63f061fa96047c5529a4170fc55c1f67828ae87c8a47b4b2362a1f80

Download Submit