afda782139dad2e9b42035ba77843c7c07d8229da965a9065f43acba57b59c13

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe
Size

680KB
MD5

04e43e9789640d238336341ad65cea2b
SHA1

5a95b361910180992d4b3cad072d51985d5be511
SHA256

afda782139dad2e9b42035ba77843c7c07d8229da965a9065f43acba57b59c13
SHA512

405caa1c6414ae9054b166108930199c2b635a5abb5500b18a02b6f91fff36d04765dc61d2edf9f6b3a95d17577a5a56160bdfead7c5489ea349d2a50fec2959
SSDEEP

12288:XvlwmT0sLMpqyysm12Qdl0NGFuqRwQ4xWTXw+5S1MypgHIh8rjpFCV:XvlwPwEHy12YgJ6wQ445S1ZTgj+V

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1328	Setup.exe

Loads dropped DLL 5 IoCs

pid	Process
2320	04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe
2320	04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1328	2320	04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe	28
PID 2320 wrote to memory of 1328	2320	04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe	28
PID 2320 wrote to memory of 1328	2320	04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe	28
PID 2320 wrote to memory of 1328	2320	04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe	28
PID 2320 wrote to memory of 1328	2320	04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe	28
PID 2320 wrote to memory of 1328	2320	04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe	28
PID 2320 wrote to memory of 1328	2320	04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04e43e9789640d238336341ad65cea2b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IDa01868\_ad9173.adx

Filesize
11KB

MD5
5fb939674dc34499d0d6b1380b9332d5

SHA1
3885e1f9590576815dabe1fb8e421204660970a5

SHA256
cf3150b08f37996fc18fcd0aa9ee9feede08db008f09656bbd9614322ef26c59

SHA512
cb6980136554cb9014b2c5f8f41734811bd2cb96fb261641bd7640ac0c2ba8c6d902feea54c441ab02d9e6ccdabc9aaa50a349d441ba3ec2aba9718e8c5f8081

Download Submit
C:\Users\Admin\AppData\Local\Temp\IDa01868\b29165.bmp

Filesize
18KB

MD5
1bea3015ed2f7b37e3b7513de8887ceb

SHA1
bc82f08033247568d59be66644abb34eea377244

SHA256
8ac66bc1dbd15b03972071cc50eeb480403113d6a68957296f70e7ba484a34d3

SHA512
136c3710aea59cdf3279fc0b9d40ba04c0b9bfa1e59be6161264f31a09214a1e160c2097f8c65e9a0174308b7feec5dadb4e567e873ceb258ec9ca8570c49c58

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP.EXE

Filesize
224KB

MD5
8de763e48b13f690dce25bea5588d4a6

SHA1
66e9d66d5e447e7cbda5a6fa1c37c1f3d387b330

SHA256
e24cd265c0a960b8c8cbc7491f9973c7d4c50229d91f06b55eb9324145da2ea3

SHA512
03fa3b98f77b34d154238870516e70b24523cd9c1e78a1454089cbe0d072e052a824d7227a7793db51a81805efaaa2ef35b65e925640b23a1214dcad1177a5d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.inf

Filesize
394B

MD5
62583f93e4cf3afb23dbfb864532c1e8

SHA1
ca44eac4278dbf4340316acd23622dfef9017a42

SHA256
0b5d2cca359ebf5a4b617b33a5e5359adce2bf803ad7d19ddf238d18046259dc

SHA512
d74e1c7b1a3513c2d7f8dee91bf699bb09e127c825d2966f385ac204bad9e31471a1b295172f12ba88a232ab7ead81f058c9ae354a5a527aa891bb35a0227366

Download Submit
\Users\Admin\AppData\Local\Temp\_ad9173.dll

Filesize
75KB

MD5
eccf1b7abfacbfe1f4b29c4aa55c8e66

SHA1
946cef2d38325a722702820e6dceb7f079eeed26

SHA256
1a33c1536f03bd14b1dcd5be16ab6ab4b94245a49ca9430f83011a301cd3b4b8

SHA512
f52e1a1bda2e8c719b864413f6a5c2703b3f123dbb504d6c69a33ed4e8455cbeb8f9166d14308dcaf7283f849f37a142820b21caae7e705c6dff9119948c4549

Download Submit
memory/1328-197-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2320-196-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2320-195-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download