1689fe27e975e03457db2eafaba6c331afd4a7630e2ea0af1436fb7caba63335

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe
Size

55KB
MD5

ead2496f6b8e63894282a608a64b0c25
SHA1

c25eb9935ff3a57677ecf4d4cf39302438017549
SHA256

1689fe27e975e03457db2eafaba6c331afd4a7630e2ea0af1436fb7caba63335
SHA512

bf06675b5283e7821a168b63f1bbd3846864e3127a420b3a1e05555b83ca285ed7888ffdace55803017dffec5452784662560aef9bb43b0bd4f151642d9a4db5
SSDEEP

1536:vLnTDnEDeE2OzgeMjtkRyC+4Ug+PRRTX2c3TWbj:v02neMjtI+Fg+/THDWbj

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1668	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2356	ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe
2356	ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe
2356	ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1192	2356	ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe	21
PID 2356 wrote to memory of 1668	2356	ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe	30
PID 2356 wrote to memory of 1668	2356	ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe	30
PID 2356 wrote to memory of 1668	2356	ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe	30
PID 2356 wrote to memory of 1668	2356	ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ead2496f6b8e63894282a608a64b0c25_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat" "
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\delself.bat

Filesize
198B

MD5
e45f4d20b5211701b6f96f0a37e5c385

SHA1
d86337af819d67354f8a7401b29600f38a558e42

SHA256
3e49ed42b4e65f926acb18de9b3701d2d919868db83f5e38d5ab3a9fbeffe4c8

SHA512
2e917eceae087956d7612f1a0757eea021d4da569c2a4837586bf509274eac0cd280d9a9f4168671adfce56a867a8759f50f5244f7397a3b9baa0f5e1139f7b9

Download Submit
memory/1192-2-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2356-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download