9a2d525ed1167fb6dec47ce9983208b1252711aff7678b9829b45640125b37a8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06329962dcb99f525a103c8056a60435_JaffaCakes118.exe
Size

125KB
MD5

06329962dcb99f525a103c8056a60435
SHA1

c4c7c6a776e95828f7fbad051eaf63a9a265675d
SHA256

9a2d525ed1167fb6dec47ce9983208b1252711aff7678b9829b45640125b37a8
SHA512

02c460058bad85108f8d130c3c32531725f7ae4b950f7caa85a2865c616f4c18aedda814ca80ab98eb02cc9b05fe2921a3ce4dd197dde73cd35ea3cc78a5fbc3
SSDEEP

3072:FwxVMhOC/dTDbq91+mno3t4QZQ34NLCh/MyqlJk3:FTfFDbRnOT4N+yJA

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06329962dcb99f525a103c8056a60435_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2312	2272	06329962dcb99f525a103c8056a60435_JaffaCakes118.exe	31
PID 2272 wrote to memory of 2312	2272	06329962dcb99f525a103c8056a60435_JaffaCakes118.exe	31
PID 2272 wrote to memory of 2312	2272	06329962dcb99f525a103c8056a60435_JaffaCakes118.exe	31
PID 2272 wrote to memory of 2312	2272	06329962dcb99f525a103c8056a60435_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\06329962dcb99f525a103c8056a60435_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06329962dcb99f525a103c8056a60435_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Devourer.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Devourer.vbs

Filesize
226B

MD5
b81853d18b81ccf36334e90111e1c736

SHA1
79e51d0de070d2d86943c2a84487dac6acff41c4

SHA256
2b36284c626d08894d33113b7ea120f7c98256a979515c3a28f4e2b072f73f42

SHA512
260b9348b6887053140e92a7fa7902504cfbce2812709fa0ee16a6a3314b15b6a370697127a4cd3deb722069e3fe638505bbe85979660b120fcd16c10ab93a6d

Download Submit
memory/2272-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download