731b3eb5eaddfbfca72025676697ae500ace49c21ef022bd6c109252a1329bfe

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe
Size

84KB
MD5

f707cd4c7d870b805dbb341d478d999f
SHA1

d196dd6207c5ccc309c37501e96c13ee73d68394
SHA256

731b3eb5eaddfbfca72025676697ae500ace49c21ef022bd6c109252a1329bfe
SHA512

dc864fa0f1fdb0ed827b28bda027e9484d6f6e1329e45415090ff373bb02036e525c557a9dbbe19f9f55a6314f5b9d64e9a1085bd63a3316948a601c65271335
SSDEEP

768:AhbnyOY4xbCrRq9Cz7z40uE29skC4y/GUcqWicajqxphsgJ7gZT41BBsV5BNQJCo:wbyB4p80Czo0u/SgpM01y3yPXYZtSj

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2536	conime.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\Skins\realevent.exe	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Skins\conime.exe	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2336	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe
2336	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2336	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe
2536	conime.exe
2536	conime.exe
2536	conime.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2536	2336	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe	82
PID 2336 wrote to memory of 2536	2336	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe	82
PID 2336 wrote to memory of 2536	2336	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe	82
PID 2336 wrote to memory of 872	2336	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe	83
PID 2336 wrote to memory of 872	2336	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe	83
PID 2336 wrote to memory of 872	2336	f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f707cd4c7d870b805dbb341d478d999f_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Windows Media Player\Skins\conime.exe
  "C:\Program Files (x86)\Windows Media Player\Skins\conime.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\dellme.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Media Player\Skins\conime.exe

Filesize
56KB

MD5
6db44d46f87fd6806265963422dcc144

SHA1
64f7dd8ab3376902a45d584bdcb723879d400812

SHA256
ce17a9c1916e6147877c256ac72ff306a90518d45859810f0020a3b6379ae8bb

SHA512
dbfb4201b42576986f4955a2d55b3b4b0d607c947887a573cc0a1eb2ac90a4a3f55266464387020478bc61c813debe009ca05c9be354b38f8f55999f55338838

Download Submit
C:\Users\Admin\AppData\Local\Temp\dellme.bat

Filesize
88B

MD5
9a7867fc1199ce92526fc23c86ee2507

SHA1
5fab840db442a88d61beb350b8037160717a95c3

SHA256
93a79c9c1310977ebfd9c2b83741ab3049e4b8993967feab5e55ffc9bf3cd15f

SHA512
0b3fe6b256a2b3b2f6165ef03a1770a6fa6757b4f5713a220d2953261fb0ee002f57c0d94a0cd53eb13231857e6134cea16b6544ce00248c56aa1cec7b06064c

Download Submit