b935e9920949fa9649afb9751bc31071a26c7d207786f5dd8a27fd58ff7c3610

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe
Size

1.5MB
MD5

011ed1ad13bc97dfe2b12d1c2d85688d
SHA1

07e3e74de08f3154c7be5ccd2a93bb595d925be4
SHA256

b935e9920949fa9649afb9751bc31071a26c7d207786f5dd8a27fd58ff7c3610
SHA512

51520119a6052afe9a4d6d84cbc1ad0591a61a0f4c7298ece649b1a550ab047f18d203f6dd25042297c36ee294ea79fa7cce88dbef380618f4740fea58e4ad11
SSDEEP

24576:vG5EOH+E7BGX6kxS1K9WzYpqXmSL4FEdQpYM2sVn69izHvIR0rRzUPHY9o:vG5EpHMK9WyemSL4FGQueV6QHKSI

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1636	011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe
1636	011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1636	011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1636	011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\011ed1ad13bc97dfe2b12d1c2d85688d_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-0-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-1-0x0000000000912000-0x0000000000913000-memory.dmp

Filesize
4KB

Download
memory/1636-3-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-5-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-8-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-13-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-14-0x0000000000912000-0x0000000000913000-memory.dmp

Filesize
4KB

Download
memory/1636-15-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-16-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-18-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-19-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-20-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-21-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-22-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-23-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-24-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-25-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-26-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-27-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-28-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/1636-29-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download