fda295b52c1eca92dbf2029e92e5196ba95cf9fb548dfd01278dfffa15f7ae84

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe
Size

368KB
MD5

f9dfda741945705068421afdf754f8e9
SHA1

ccccbe1be7a3bb62ba5613866bb53f96ec955ea7
SHA256

fda295b52c1eca92dbf2029e92e5196ba95cf9fb548dfd01278dfffa15f7ae84
SHA512

6d02d523ef5507248a743c249a7386cfb4ae80a9e1a2547ae0b1058078778744f784ddfff28e15f24cffa3e904b95bcbc7a0e5c3653d05f8452686b3a7f4928c
SSDEEP

6144:me7S/b3TYs8veSl1PBihz0NYv07tBsrOUbWbCZ5Drr1C+5D1dKtTB5Du:yb3TYs5SDEhz0NYksrO5Y5D1stTbDu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2780	server.exe

Loads dropped DLL 1 IoCs

pid	Process
2508	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
348	DllHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2508	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe
2508	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2780	2508	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2780	2508	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2780	2508	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2780	2508	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2780	2508	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2780	2508	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2780	2508	f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9dfda741945705068421afdf754f8e9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  PID:2780

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\×ÔÅÄÂãÕÕ.jpg

Filesize
211KB

MD5
b5930f8dae19c1e6264246cc32f42021

SHA1
883c3eb58079f620f7f79136a30a688a6cfcb6f3

SHA256
31b3c843171983c18b1792ec66581e44f85202b41bf78b657c84f33b327efe3c

SHA512
8efe8c1cf7ba4496327eba19ec882f28bb4a058f193c6c840720d31183623b9ece6a1b1b065a8350ba8a07a0064cfda154c9dcc7f42af4e6773b0519a5e9f56d

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
128KB

MD5
2db6d9be6d6aeb12e9b49c0e7cca7d19

SHA1
3f73851df6dbbca9bfc914833d5e74b101a92ba6

SHA256
cd3f4152580026cc386c890a869a40c336c4cce1f057b77fb648125cd955d0d7

SHA512
0c271f2cb9a9607ed0dc2f119faab2f227ae8bcf8f554cd461841ed62231cd74418b8918d82bf4a5b42d5444f7f32763d9445fad556aff5f84e4e9ec9adc5612

Download Submit
memory/348-3-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download
memory/348-5-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/348-12-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2508-2-0x0000000003300000-0x0000000003302000-memory.dmp

Filesize
8KB

Download