9bc8e6571e16becf698bef81c9479d65d6d80fa5f11239915517292cb9955737

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec19684b75218ccc9705b6754c565cd1_JaffaCakes118.exe
Size

15KB
MD5

ec19684b75218ccc9705b6754c565cd1
SHA1

895ee4ae8d815c1c8259b54499b4119a5b78aabb
SHA256

9bc8e6571e16becf698bef81c9479d65d6d80fa5f11239915517292cb9955737
SHA512

caaae99b90e6efa42678b4908bc79df9265230395eb90d582c8c9af2ba5ff4108e8888349c192ff1b19cbf8c319dd3ad3ac2a7dc4b20dadd127f08abf3807e26
SSDEEP

384:k4f9+Lk/x6gNwUmhaxkjAwqKp3WKLdSKQJ:T0vg9xkcRKZWK8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec19684b75218ccc9705b6754c565cd1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1688	ec19684b75218ccc9705b6754c565cd1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	ec19684b75218ccc9705b6754c565cd1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1236	1688	ec19684b75218ccc9705b6754c565cd1_JaffaCakes118.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1236
- C:\Users\Admin\AppData\Local\Temp\ec19684b75218ccc9705b6754c565cd1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ec19684b75218ccc9705b6754c565cd1_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\showthread[1].htm

Filesize
18KB

MD5
dba25bf721fd3c724d077b3c111c7f1a

SHA1
e02c4e8d7978989fe28a3722d290cc8f5a2645c0

SHA256
0d1ac6489ebacaf50a7ac38eb63d3474c34fc9fad69e843e1f12507954493be7

SHA512
931ac76784a1d2c7e824af82fd3fa156f8f9684d539a09b578903bfca4cf3ab0ddf59f0ffeac371107857bc3794300cd253fbe529742d6d8e3384d374868b20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#533.tmp

Filesize
18KB

MD5
3bd461eec0717240bd415446cb3edc21

SHA1
180f8f1879209c85daa06c4b9eb919c4b966f1a5

SHA256
891de2afe8dab3a8469ed6a61156a9b436f95612a0d0a57d7b8fbd2004623b99

SHA512
dd8daa432006b4fd1a127f296c2f086b9a60e3989dc00b9b8f155bb83a656900d423741c845c59f9f708d80f20d2e98ad79b4ede1492cb8246d8fe67170b8067

Download Submit
memory/1236-1-0x0000000002AC0000-0x0000000002AC2000-memory.dmp

Filesize
8KB

Download
memory/1688-0-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1688-12-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download