53d0b63e0ca5ec9207daac2d8be9ecccac6e105928af6e5dd5b5f8274879d941

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe
Size

64KB
MD5

f98a95a794a10764e3f7881e65990c05
SHA1

c5ca78ff950a73c53f270117b49fccb35b8d7739
SHA256

53d0b63e0ca5ec9207daac2d8be9ecccac6e105928af6e5dd5b5f8274879d941
SHA512

e4ed6209ab94b8d100f6a5f8a18adaa019ee125de7fb79c051e5334a02f8fe85240f148f7fb0928488aa9a2414ef0fcf35659daf5da10c54ffe73287ba416f5a
SSDEEP

1536:XhHdIlWMQx4IdUsnnuEm+/7zfeyZJ948LrXK:XhH2lOzd7nuEpSM944

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2908	cmd.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2372-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2908	2372	f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2908	2372	f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2908	2372	f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2908	2372	f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f98a95a794a10764e3f7881e65990c05_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Mbp..bat" > nul 2> nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mbp..bat

Filesize
238B

MD5
c38bd01dabf5dc299c26c138adf09388

SHA1
6918e53e926ea6ae860dd6547198173605a8d878

SHA256
fd14f1a13a2ff287f6f9580b35095c62f5dd6fbdf8e628b49b91ca5a9edd1d3b

SHA512
7abfcfe6fd4d0ac8ceaeabaa8b1e810e193da47aac401ef119e166acd8705817813c34b60a2b4e843bc2ed63dc633447e46bd66baf6694f193f8e93a6d2fd167

Download Submit
memory/2372-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2372-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2372-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2372-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2372-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download