9a8de61e8e4898d86adae8ec0cc45671eae9742d7ab104f0d1960d695e48282b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe
Size

83KB
MD5

eac9aa3b48634bf638bda8ca17d28e2d
SHA1

89dfdab326477f443ea7828733506ed4b318fba2
SHA256

9a8de61e8e4898d86adae8ec0cc45671eae9742d7ab104f0d1960d695e48282b
SHA512

4bd031e0eb58d94be01190fa470d51e3d55418000705f3a73ce4bfd8d6102263ff475f08ab936c8ed35c7ae7241e9660f577db05e393a9451151dfebdbb98f41
SSDEEP

1536:gBOhV9Eg5kTWiksvLkuoD5AMkEUU67eqtCZFKI/F9CgSGujdR:OWV9b5KWikaLkuQ5QEZ67ztCZFv/F/ub

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2324	sservice.exe

Loads dropped DLL 2 IoCs

pid	Process
2100	eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe
2100	eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sservice.exe	sservice.exe
File opened for modification	C:\Windows\SysWOW64\sservice.exe	eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sservice.exe	eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sservice.exe	sservice.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2324	2100	eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe	31
PID 2100 wrote to memory of 2324	2100	eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe	31
PID 2100 wrote to memory of 2324	2100	eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe	31
PID 2100 wrote to memory of 2324	2100	eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\sservice.exe
  "" "C:\Users\Admin\AppData\Local\Temp\eac9aa3b48634bf638bda8ca17d28e2d_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\sservice.exe

Filesize
83KB

MD5
fe6836bcae3ef3d766e2626040deaedb

SHA1
e7840246bd12ebcc2208ef054bef2ade70fe637d

SHA256
cc625190b90561661abcdaee1d373e8e3b264a7aeba31f0c074714d8270ba804

SHA512
c7b46608900cf2e27ea87fe5133d889ac4097c5df9c1fd0a372df1c91f74138db05a541d086877d13c0bf46d6c2f884c46a9dd75aeb5b7521c10a0aab462fb74

Download Submit