621202764da6d4b8fd9ae8dd15a0204dfec5d8941b42e86c3ee3aac01df90cd8

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe
Size

3.2MB
MD5

eac7a15fa8096f6c678bba2dd3ee584c
SHA1

d1db26680cf0e678acd1909bb860cc2f16b2255c
SHA256

621202764da6d4b8fd9ae8dd15a0204dfec5d8941b42e86c3ee3aac01df90cd8
SHA512

e203d46cf7c4af673e6003b97079408ea95c70c3c6176f2ac4059513de91680570bb6677350a57840da30723d6a277068c9c7a7c6161f9c7b094b9cbdecfa1bd
SSDEEP

49152:u8fIo2ysJlvGtOXyspW1CGAzihxtTlJj4ORRrZ0s5PKYTKUbge2mv/8C:hIo2yIGIXyRxhl144rFVge2mv

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	1200	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1200	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe
1216	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe
1216	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe
1216	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe
1200	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2900	1200	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe	30
PID 1200 wrote to memory of 2900	1200	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe	30
PID 1200 wrote to memory of 2900	1200	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe	30
PID 1200 wrote to memory of 2900	1200	eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 344
  2⤵
  - Program crash
  PID:2900

C:\Users\Admin\AppData\Local\Temp\eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eac7a15fa8096f6c678bba2dd3ee584c_JaffaCakes118.exe" -downpower -msgwndname=wpssetup_message_F77EACC
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\tempinstall.ini

Filesize
295B

MD5
96c80dae049f254e5350b2cbcb8c0fee

SHA1
838cce0b62f33c33d63135388762687d943e2a1a

SHA256
7da37cebe579dce2b2ec9a7ee8887655bf58ed8f37b81bbb9ae0c892306b671c

SHA512
1336e6e1c742d4debc87720d8c67fbacd3f39da812c936c87ef558b3a9ee80d4dc964eb4da5ff74b7b7b938ed2d7c7cc83978673835c8d1d1abd64a617fd6386

Download Submit
C:\Users\Admin\AppData\Local\tempinstall.ini

Filesize
330B

MD5
ce733119e104724fd1b9c474a8fe859e

SHA1
813b25d9752f8b3acb43bf4988348b0918762e3d

SHA256
17c1de0ef5bdfac7efa90f262e1a98728becbc31998176f72ffe3dcc7a86398e

SHA512
eb1d7e404e958f2f3d85a7f8a8030d0dd8f4c3e6638f6706a5787042c08808fc12a44661ac0188c41ecbdc7aed50e299f86cc8587c063fecca0493783fcc58d9

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log

Filesize
150B

MD5
b416992c1764d9b97cde4e34fced4757

SHA1
4c0f5f341bd0ebab43cb96abc6ce6a040deca358

SHA256
e03996dda41718b0c88e6447fec75e6da277cc53d28177cf586fc9013f46fa89

SHA512
d58ceba392bd8a73b282ccd0d4dcaf1c72cea586d6e86aef0e86eb1dfbf41732f4916057681b652f9af911513fe377c4d74af6f0b5fab94028885f31807cf9ca

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log

Filesize
998B

MD5
af3703075396115634e71f93e90e1af7

SHA1
7ab72c79595dea0d37cd9c489ff1470e2ff055ab

SHA256
987e03554a4d86a413a6ee96bac76a45f5bdd2edb45f2a4c9965b3c65e760d8e

SHA512
7632ba75d27cd84abfc15d520a58601c02db04e1267e09d5ca1b30dfbd4bfea6317adf4c1e1488e7bb3f7f4a06702e5485865eb8b765708c91cef997e7cd5d3b

Download Submit
memory/1200-1-0x0000000000840000-0x0000000000842000-memory.dmp

Filesize
8KB

Download