cfa0ff3b05c275b0ffb2db738efab9fcb6990f93b8760f4f79cc53ed3d3b9b60

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 05:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe
Size

20KB
MD5

ef26a55982efdc21cc0ed49f195582b4
SHA1

a999fa6827d54b252af2f1568ae0ae3995f9de10
SHA256

cfa0ff3b05c275b0ffb2db738efab9fcb6990f93b8760f4f79cc53ed3d3b9b60
SHA512

ccc3848ed6204b8e8ff12efe36090d8f0b2e002bf1d84d9028d2e673fb968b646bc20d02192e51938aa0e00b8b0735ab57a3c3a606d1bc3d02f1f3d83c1cde83
SSDEEP

384:iI6BtT9wPwvbwKiRtn/kctBeskAljivn7oMN9ysz0mUOspjUGj+6:kTa/kGe6mnv9TEOEgGC6

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\olepro32.dll.DEP	ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\olepro32.dll.DEP	ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\VGA8279.ime	ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe
File opened for modification	C:\Windows\system\VGA8279.ime	ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2504	ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe
2504	ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef26a55982efdc21cc0ed49f195582b4_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VGA8279.tmp

Filesize
26KB

MD5
f4d580a2f6d294efd5866f0a96cddd35

SHA1
25d43dc132b4c6bf6c9213c3d4d3c4c1998124f4

SHA256
c37b03b4175e40b642275bf3b4b0dc62108cb927255c5ac5320b5bcb8dea603c

SHA512
9813100d1afbe8459adeb0464b23b2c6c903ced824371ea691fe7250c5bbb590a53a598ab3176c63d4b186ed68815882fd75855ecb1b746f10db676593aaabc3

Download Submit
memory/2504-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2504-11-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download