05d041cfb5c39b216335c1298650d05c7a1094389917a6ca9240553981f40f95

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe
Size

408KB
MD5

eb5b333d3de37116d6273915cbb2fd80
SHA1

b00878b4dbbe13194f2f80015e8d619e95d32c36
SHA256

05d041cfb5c39b216335c1298650d05c7a1094389917a6ca9240553981f40f95
SHA512

d10f94d96fabc1cd64b1edabdea6d47f43b9b0ae7ae589bb2e67e29267889729cace2163a0009d0c6636298e873a121d8f6d229550b1ed7141b34815ae67818f
SSDEEP

12288:mMvyWHKgDeKYn4UlQ7LJaM4C6YoyBvPDMe/:3lBMQ/JanCoyBr

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\drivers\etc\s2er333vice9.ini	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1212	interface.exe

Loads dropped DLL 2 IoCs

pid	Process
1620	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe
1620	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	\??\c:\program files\Realplayer\handling\interface.exe	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	interface.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1620	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe
1620	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe
1620	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe
1620	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe
1212	interface.exe
1212	interface.exe
1212	interface.exe
1212	interface.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1212	1620	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe	30
PID 1620 wrote to memory of 1212	1620	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe	30
PID 1620 wrote to memory of 1212	1620	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe	30
PID 1620 wrote to memory of 1212	1620	eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb5b333d3de37116d6273915cbb2fd80_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- \??\c:\program files\Realplayer\handling\interface.exe
  "c:\program files\Realplayer\handling\interface.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\Realplayer\handling\interface.exe

Filesize
408KB

MD5
bde779494f72972dc8cfcfe37a5aaef2

SHA1
9ca674ee48c94689c8bb77b26c7136d75a44caa1

SHA256
b6e8cf2210b84c5d04cc09eca93380a4ff89b1e498728d9ca62145ea51199bb7

SHA512
29a2dba398b5f6f3843ded96705684ac5b974a9a842a3875008091d035aa24b8a1281ce1817baec2b5aef5dabb675181e6705b0c2d6486cd62a09a5e6cc0eb47

Download Submit