668b8ed8f01cbbc5e8cc828b27b47ba72245eea9300f5b25fa434efdd5e955ea

Analysis

max time kernel
146s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe
Size

3.9MB
MD5

08423850e86acb1a6765ab931ad266fa
SHA1

79e08264661062557dc0ee65ded64a9033908dfd
SHA256

668b8ed8f01cbbc5e8cc828b27b47ba72245eea9300f5b25fa434efdd5e955ea
SHA512

701fb2cdd1f8751b3cddea8ed565d2a763a7397b82336c2d64146f05e0e87194a666f4d6072f2b02084e8f2b30d67a9ba0696371f44d4a6616181fe2b04912da
SSDEEP

98304:owV6HxskamOIxJiEl7B491NGYGn5fCmJ+MqVB4/x:oqWTOYJL2ny9XRqS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2696	explorer.exe
2756	iexplore.exe
2776	explorer.exe
2568	iexplore.exe

Loads dropped DLL 4 IoCs

pid	Process
2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe
2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe
2696	explorer.exe
2756	iexplore.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2248 set thread context of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2696 set thread context of 2776	2696	explorer.exe	33
PID 2756 set thread context of 2568	2756	iexplore.exe	34

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe
2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe
2776	explorer.exe
2776	explorer.exe
2776	explorer.exe
2776	explorer.exe
2568	iexplore.exe
2776	explorer.exe
2568	iexplore.exe
2776	explorer.exe
2568	iexplore.exe
2568	iexplore.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2240	2248	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2696	2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2696	2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2696	2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2696	2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2756	2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2756	2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2756	2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2756	2240	08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe	32
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2696 wrote to memory of 2776	2696	explorer.exe	33
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2756 wrote to memory of 2568	2756	iexplore.exe	34
PID 2776 wrote to memory of 1760	2776	explorer.exe	35
PID 2776 wrote to memory of 1760	2776	explorer.exe	35
PID 2776 wrote to memory of 1760	2776	explorer.exe	35
PID 2776 wrote to memory of 1760	2776	explorer.exe	35

C:\Users\Admin\AppData\Local\Temp\08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\08423850e86acb1a6765ab931ad266fa_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\explorer.exe
    "C:\Users\Admin\AppData\Local\Temp\explorer.exe" --mn=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\explorer.exe
      "C:\Users\Admin\AppData\Local\Temp\explorer.exe" --mn=0
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\19669.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
- - C:\Users\Admin\AppData\Local\Temp\iexplore.exe
    "C:\Users\Admin\AppData\Local\Temp\iexplore.exe" --mn=0 --ch=1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\iexplore.exe
      "C:\Users\Admin\AppData\Local\Temp\iexplore.exe" --mn=0 --ch=1
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\19669.bat

Filesize
183B

MD5
bd72ad290116629dd71f4938cf6e7dc1

SHA1
c552a0f2e2a484fb13b28a1741e308ee8b8a131e

SHA256
47badefbada1a8a763ffaf1571af031ce26b535bd8234bc6954621fbb676f10d

SHA512
ad957f1efaa8aad55d3e93c0e12fcd7e54912272ab2331986be1169cc9105b7a24de4b26a5b2f2a7c4d1b3463bca4acd52fec5a7af65ea407f54e1a5680c66e5

Download Submit
\Users\Admin\AppData\Local\Temp\explorer.exe

Filesize
3.9MB

MD5
08423850e86acb1a6765ab931ad266fa

SHA1
79e08264661062557dc0ee65ded64a9033908dfd

SHA256
668b8ed8f01cbbc5e8cc828b27b47ba72245eea9300f5b25fa434efdd5e955ea

SHA512
701fb2cdd1f8751b3cddea8ed565d2a763a7397b82336c2d64146f05e0e87194a666f4d6072f2b02084e8f2b30d67a9ba0696371f44d4a6616181fe2b04912da

Download Submit
memory/2240-0-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2240-4-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2240-10-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2240-8-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2240-6-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2240-14-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2240-2-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2240-12-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2240-17-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2240-16-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2240-72-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2568-69-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2568-83-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2776-48-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2776-80-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download