05bd4e1d63bb272553a3f1a8c5242b9cab370bfa7e556b3d8116c83fac5e43e2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe
Size

50KB
MD5

eb0d7f51910ec6e015f78c1f83e3d31a
SHA1

3cb08be61cba2b60fe863f0e61deb0d3c2af871e
SHA256

05bd4e1d63bb272553a3f1a8c5242b9cab370bfa7e556b3d8116c83fac5e43e2
SHA512

1f2601140ec691e40efe397887c85ec50822d4cb0b817a594b421c08a8095ce9a0bbc0c99fe6873cdef37bb21e106fea15fc5ce16a6bf51fb7b80cc750ea5b56
SSDEEP

1536:Hk8qjQVbslQm8BnhDxhCuKOohl+nbgUzCy/9ZbR2IN:HkApzm8B5xhCPhlygUzCy/9xRZN

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1120 set thread context of 1628	1120	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe	28

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1120	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe
1628	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe
1628	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe
1628	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1628	1120	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe	28
PID 1120 wrote to memory of 1628	1120	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe	28
PID 1120 wrote to memory of 1628	1120	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe	28
PID 1120 wrote to memory of 1628	1120	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe	28
PID 1120 wrote to memory of 1628	1120	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe	28
PID 1120 wrote to memory of 1628	1120	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe	28
PID 1120 wrote to memory of 1628	1120	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe	28
PID 1120 wrote to memory of 1628	1120	eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\eb0d7f51910ec6e015f78c1f83e3d31a_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1628-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1628-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1628-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1628-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1628-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1628-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1628-47-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download