1fbfb52f7e1fa7dde6de5e73cc8e892e6e5c3d6509af45a13cff0df290fc42cb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe
Size

5.8MB
MD5

0bf2db23e3d59959789f36dd81e44d8c
SHA1

9dd7b43d6320f61cdf9d8cea9bea77f1eca783a1
SHA256

1fbfb52f7e1fa7dde6de5e73cc8e892e6e5c3d6509af45a13cff0df290fc42cb
SHA512

7a1e6e0980ac7547e74d0f40e18ebeec1fee719726d6076d45c0eb0eddf8f72c0e9ab6173091497ed49909fac8a2327d5a0bda978862ecbefbe31e80b3a6a199
SSDEEP

98304:cz/o82f07pMzdIGHaz8bBfTnq/8urP8jRmFJFnZrQbBrUCvkkFmgI8DM2cWd8fWV:Cg87WJYCfE8uDX2biCNBpDcWda7C2T3o

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2916	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2792	spoclsv.exe

Loads dropped DLL 2 IoCs

pid	Process
2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe
2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe
2792	spoclsv.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2916	2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe	30
PID 2504 wrote to memory of 2916	2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe	30
PID 2504 wrote to memory of 2916	2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe	30
PID 2504 wrote to memory of 2916	2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe	30
PID 2504 wrote to memory of 2792	2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe	32
PID 2504 wrote to memory of 2792	2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe	32
PID 2504 wrote to memory of 2792	2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe	32
PID 2504 wrote to memory of 2792	2504	0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bf2db23e3d59959789f36dd81e44d8c_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\96$$.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2916
- C:\Windows\SysWOW64\drivers\spoclsv.exe
  C:\Windows\system32\drivers\spoclsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\96$$.bat

Filesize
569B

MD5
e199dc239ce2fde249dc4ac9b50011a2

SHA1
c59b75c6b682fcfe15f2d48a89ce218f51ede99c

SHA256
e0e03628e0dabbd06f60fbacf542fd7452c63eb1f30e3bd17a8df60ace53b632

SHA512
d6d2ed6befae2c47c9577d3bd8aaa35cfd9db3afc9899ee45b19dd40a1d3f2f960b8367596d877880671b5025dbb2206f8493b53feb84da869d0f99e3d7d1e63

Download Submit
\Windows\SysWOW64\drivers\spoclsv.exe

Filesize
73KB

MD5
28fc456f77f891b0fe9a077d0f526a5f

SHA1
638a1380e082974269088399d9875670cf11b714

SHA256
51957285253be0150af5636c29403b3a514615cd63a1bc2f8a9194b972704cc9

SHA512
80bb1ae5a0fe747f32140923bf360e342b796ca22c864b4b713e1d1b4a20680dc95ea6c6fcf7f6ea3a41652d2258f7ae43a19106dbbc47df850cf6947bbf496e

Download Submit
memory/2504-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2504-1-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2504-19-0x0000000001F80000-0x0000000001FC4000-memory.dmp

Filesize
272KB

Download
memory/2504-22-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2792-21-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2792-23-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download