d567488c0df5a464780637f19ba8f439260e60807a8aac133caf19a602deed6c

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe
Size

97KB
MD5

eeb0e7c25e011504d8b0494cb76566cd
SHA1

6de68b897ce3eb49fb221ee7a85d12666e88824a
SHA256

d567488c0df5a464780637f19ba8f439260e60807a8aac133caf19a602deed6c
SHA512

36fa4d22ed9c5f5b4792e23b54ff6642a7ab14b2c76a1c855cb10718b141bf78172264f84a8ff8d894f69cc28732acead744d4acf8ca5a2c7d5473e5e474b0ba
SSDEEP

1536:K+Ak2NM+6qbymCcoxC4j6VJ37Kb1byOCVxJMbeV/FkCr/XxXdX1VtJ2eIqS8Al:22coxC4j6VJ3u1byOCVxK0/mCTnDfc3

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1044	Traffic Bot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Traffic Bot.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe
Token: SeDebugPrivilege	1044	Traffic Bot.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1044	1172	eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe	31
PID 1172 wrote to memory of 1044	1172	eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe	31
PID 1172 wrote to memory of 1044	1172	eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe	31
PID 1172 wrote to memory of 1044	1172	eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eeb0e7c25e011504d8b0494cb76566cd_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Local\Temp\Traffic Bot.exe
  "C:\Users\Admin\AppData\Local\Temp\Traffic Bot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Traffic Bot.exe

Filesize
287KB

MD5
cf9bec787e437ac0a28058c250993bdf

SHA1
7124aca070c0dc0990c4b77e5e6cec30bbbf4537

SHA256
a39eff4521d8491565a347e297ba508ce85d99ef3c1e057c90c4037c6e4d8610

SHA512
18360420eff788efdd02ca96a25ba0d8856b63be86d377b5c26855c335101679b744e56fd1daaf146a703ae93e3215342f595d1e4ea03f631a823045c8317c7d

Download Submit
memory/1044-10-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download
memory/1044-11-0x0000000000CA0000-0x0000000000CEE000-memory.dmp

Filesize
312KB

Download
memory/1044-12-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/1044-18-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download
memory/1044-19-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/1172-0-0x000007FEF59E3000-0x000007FEF59E4000-memory.dmp

Filesize
4KB

Download
memory/1172-1-0x0000000001370000-0x000000000138E000-memory.dmp

Filesize
120KB

Download
memory/1172-8-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/1172-17-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download