ee2ee3c62272e63670d27dcc3adeb4a4806c5be1738d0a879118bcc9f51981c7

Analysis

max time kernel
142s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe
Size

347KB
MD5

0b053df57182c4f70f71f52d7e722d31
SHA1

a773f0b49b5882bbf629956cd6865a7b143d26b8
SHA256

ee2ee3c62272e63670d27dcc3adeb4a4806c5be1738d0a879118bcc9f51981c7
SHA512

d0293c7bd183d2a1cc7a391e03c7057def2e2a09e34ea378d918e88d00ed34013b9ddccbb0fc1a5e1c14838908c95dfcb1ebcc24eeb0771465f2a115ad6eacae
SSDEEP

6144:LXcuMYZla0Z6wpDqIIt7kv5KeF0WnAVKS8KZ7yHfd6LjJoxGq6IE5k:LXc9J0ZZDqIIZQKeF1nAVKSp7y4FYGqr

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1944	server.exe

Loads dropped DLL 1 IoCs

pid	Process
2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1944	server.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: 33	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe
Token: 33	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe
Token: 33	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe
Token: 33	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe
Token: 33	1944	server.exe
Token: SeIncBasePriorityPrivilege	1944	server.exe
Token: 33	1944	server.exe
Token: SeIncBasePriorityPrivilege	1944	server.exe
Token: 33	1944	server.exe
Token: SeIncBasePriorityPrivilege	1944	server.exe
Token: 33	1944	server.exe
Token: SeIncBasePriorityPrivilege	1944	server.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1944	server.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1944	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe	30
PID 2656 wrote to memory of 1944	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe	30
PID 2656 wrote to memory of 1944	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe	30
PID 2656 wrote to memory of 1944	2656	0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b053df57182c4f70f71f52d7e722d31_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.01.11T07.05\Virtual\STUBEXE\@APPDATALOCAL@\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.01.11T07.05\Virtual\STUBEXE\@APPDATALOCAL@\Temp\server.exe

Filesize
17KB

MD5
2b5cf707e94c69fa76ddc6f3613b1482

SHA1
05f5cae23e7074cfbad6145d1d74d14508eab704

SHA256
5ce38492be11bd2851b3553b25614c1b09c248c66c770a3af676bb86c402c2ab

SHA512
82e0714a31876993dfac5900cc01b0132a2ad47a3472069659dc60c0cc3805cb74fd714c91ea353956c56fe8c1a12092f24b2c06596244d7d365d9ca3cdfc844

Download Submit
memory/2656-36-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-24-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-1-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-18-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-6-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-35-0x0000000077700000-0x0000000077701000-memory.dmp

Filesize
4KB

Download
memory/2656-34-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-30-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-28-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-66-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-0-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-22-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-40-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-20-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-16-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-14-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-12-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-10-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-8-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-62-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-186-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-221-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-4-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-271-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-26-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-302-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-282-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-281-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-257-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-241-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-216-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-207-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-206-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-187-0x0000000077700000-0x0000000077701000-memory.dmp

Filesize
4KB

Download
memory/2656-64-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-60-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-58-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-56-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-54-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-52-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-50-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-48-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-46-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-44-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-42-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-38-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-2-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download
memory/2656-616-0x0000000000370000-0x00000000003DC000-memory.dmp

Filesize
432KB

Download