69575c14a1c5042d007bfd65cae3fcb921491491bc3e8741059478a381768947

Analysis

max time kernel
149s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
Size

232KB
MD5

0ae5390cd69537cc999bc9d5b943c382
SHA1

f042e0323fd37567825bafb601fe18ce3594b359
SHA256

69575c14a1c5042d007bfd65cae3fcb921491491bc3e8741059478a381768947
SHA512

b0412e99459a4ded6fe396e33945e72a4b5dba115aa57d4d230a749b5e831d48a9912575957557044f09813f571fda09ab2bbd7c51626e0a14657a7f09ab01aa
SSDEEP

6144:5VdHl5i0Mm6aQc6UeI77KVgS/wnjhHFpG4b3k:5VdR16TBUJKVgk4jhGmk

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2848	2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2848	2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2848	2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2848	2312	0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ae5390cd69537cc999bc9d5b943c382_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin31BB.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_tin31BB.bat

Filesize
44B

MD5
a29554ea69f6f4055b46aca9e309a6a1

SHA1
5c462932616f7f06024e61bd5475c1579c152070

SHA256
4ae4fcedb3c8d698276f4bac0b6e71fe9990edaa3a329df1a4ee333d97d98fc1

SHA512
3311181738daabd3e3f0ffd9f370a54d2e78cf7154a5adbad9e33ec862bbae2c27009b2f9b034bda47da92025dcb23c0c6d10bc2d3c6a50f5ce367193046e349

Download Submit
\Users\Admin\AppData\Local\Temp\CAC5712D\_Setup.dll

Filesize
146KB

MD5
a3f3a3b608f9a6d604730cb689dc23c6

SHA1
67dbeb74940250916e0592e596aa492c09694f74

SHA256
4020fabec983278cb2f9b1eaa17cd9466bbdbd0842a35182e34ecd302ae9d342

SHA512
beb0ad1f1b2530366dbc366a642d27965d7e851055086d7c302612eae88d19a501d46c66737c8ee4d0d0c2915d9768cd4d2f1b8e5347bcc3480facdb73484c84

Download Submit
\Users\Admin\AppData\Local\Temp\CAC5712D\_Setupx.dll

Filesize
16KB

MD5
f17dce858db6f84c1c149f8aebb1ce58

SHA1
e54f8c536dd66610d0678a3532c4f8834b01abe6

SHA256
f32c9be19334ec4a212d173f43e3a97e08434000ff7cef8584afbf72e05ba845

SHA512
c08f9efb7a3514c7829d7c9bd0ef384bbe038e695021a089b354eab6e9c13408fab31a01f502013c27c1a50e2e223ad3c33f4ed7424498b4077091c0044b7ce7

Download Submit
\Users\Admin\AppData\Local\Temp\Tsu-0908.dll

Filesize
245KB

MD5
8c7a58965b71c9dfbf1a14d3369a2620

SHA1
26380249b9bdf1ab864b1c8fa4d01e4c28ba9b5c

SHA256
f94e3692cf74256ef5f9df081592603e5b3aac4490ce39cf88363c5f24fa5aa7

SHA512
97302e9a0f53fb7239c92049d61d65be2958de3d674cdc25fb2ac10424814930e982278d6d6e8df2e270116a5a1b7d1cfea14250aea99191f3efd571357c7023

Download Submit