2b3ef0ee83fd79e2c40902d57944bf2eb5adfb8d20a9375140a2c1576ee1de55

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe
Size

2.8MB
MD5

0f12c3f574b77fe9ee6874150c41ec38
SHA1

88e9e3b2009d06284d665d2edaf21181749aaa37
SHA256

2b3ef0ee83fd79e2c40902d57944bf2eb5adfb8d20a9375140a2c1576ee1de55
SHA512

a70999d07e3fd7ea533969d283f1f911bf091bded608fdb130173dbcdad1eef19e44c1b89dab11e7ab2aa3690b01a760a6482492819125b52f50d127f6af4418
SSDEEP

49152:EQFRHrmQG+AQG+qQG+VQG+XJQG+jqQG+d+XJQG+0OMR:EcKNjeafTp

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2828	zuq.exe

Loads dropped DLL 2 IoCs

pid	Process
2820	0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe
2820	0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuq.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	zuq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	zuq.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2828	zuq.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2828	zuq.exe
2828	zuq.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2828	2820	0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2828	2820	0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2828	2820	0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2828	2820	0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\zuq.exe
  C:\Users\Admin\AppData\Local\Temp\zuq.exe -run C:\Users\Admin\AppData\Local\Temp\0f12c3f574b77fe9ee6874150c41ec38_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\zuq.exe

Filesize
3.4MB

MD5
b6d149ed523f5f76cd9c75067b096154

SHA1
4c5623d25c31056dffbb8b3c9d0dfe4b3add682c

SHA256
e977863e8536b248a7e6b4fe50722edc848f939bb223bd89d8c30d11a5d3fb9b

SHA512
ada25825f15e8f0ecb23c0b6ea8be2a1daa56f6cf01344f9596fcae6a04f432c33befb9544d2413b1dfc0465439aa9f98186002c32432bfa7bc185e4d99dcace

Download Submit
memory/2820-14-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2820-19-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2820-32-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2820-31-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2820-30-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Filesize
24KB

Download
memory/2820-29-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/2820-27-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/2820-26-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2820-25-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2820-24-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/2820-23-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2820-22-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2820-21-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/2820-20-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2820-1-0x0000000000320000-0x0000000000370000-memory.dmp

Filesize
320KB

Download
memory/2820-18-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2820-17-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2820-16-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2820-28-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/2820-15-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2820-8-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2820-12-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2820-11-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/2820-10-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/2820-9-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/2820-13-0x0000000002B00000-0x0000000002B01000-memory.dmp

Filesize
4KB

Download
memory/2820-7-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2820-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2820-5-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2820-4-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2820-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2820-2-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2820-0-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2820-57-0x00000000032D0000-0x0000000003406000-memory.dmp

Filesize
1.2MB

Download
memory/2820-44-0x00000000032D0000-0x0000000003406000-memory.dmp

Filesize
1.2MB

Download
memory/2820-43-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2820-42-0x0000000000320000-0x0000000000370000-memory.dmp

Filesize
320KB

Download
memory/2820-41-0x00000000032D0000-0x0000000003406000-memory.dmp

Filesize
1.2MB

Download
memory/2828-46-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2828-58-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download