e04b9ea8d977059ae11c0f9ed5b4dac36195c2dc569b8cc1cc7f9b8e95ce7eec

Analysis

max time kernel
121s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe
Size

188KB
MD5

eebe41bea4001decb58d5d64a42c9dc6
SHA1

778d20e8f40241586f0158078bf08515f0f08721
SHA256

e04b9ea8d977059ae11c0f9ed5b4dac36195c2dc569b8cc1cc7f9b8e95ce7eec
SHA512

95f2d90e890f3b46e941d8f2591b029df2b2de53552e010da5199cddaae7ea78c63e2f42756a5bc1c57cba96f8a202639eb3233610f08a4f2b90f2f136e5609f
SSDEEP

1536:EvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcj0Srowm0:EvVQLIkLWeaA8KlCph9hrowm0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2416	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2360	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe
2360	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\9135f82d\jusched.exe	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe
File created	C:\Program Files (x86)\9135f82d\9135f82d	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2416	2360	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2416	2360	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2416	2360	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2416	2360	eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\9135f82d\jusched.exe
  "C:\Program Files (x86)\9135f82d\jusched.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\9135f82d\9135f82d

Filesize
17B

MD5
7bdf61d37c9adf3e1c6937107016091f

SHA1
56b8e0c454f9dd16d508a04b3afa7e458453ac41

SHA256
4c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0

SHA512
ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1

Download Submit
\Program Files (x86)\9135f82d\jusched.exe

Filesize
188KB

MD5
c89d97f9d0c6b0b4619f32a9b1280465

SHA1
50a4d1fffb9e163133ac48a91b4da6fa9a8bb553

SHA256
fb00d1269110697fb390aca7560519566919dc631c58050aec6d1d4ce1f35784

SHA512
17e93065279e1d74cf1596565daf7cd645b5e4ddb55973f4ed1a31500de193fb0f3542243bd46603d5aa1289cd90647cdecc5ec8295eac74ddfe5d5447f7f4b2

Download Submit