4d3e47aa7906ec10be9ea8fdf77d244febd30e6e9a1b6c031823d0bd84f83fb5

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe
Size

24KB
MD5

104430c923522d90dd9e3fc15df6d950
SHA1

709cc8c018a7d2b416a06224c411870a1b9077ad
SHA256

4d3e47aa7906ec10be9ea8fdf77d244febd30e6e9a1b6c031823d0bd84f83fb5
SHA512

f39b8989cf425b8d09b35f801d707681ebe585661e53ba3429fe27aaeb67ef3ba105ae34c07a1dd749d7453f3063a537c6d7f381eabd1d5f3eb1e2d35e37304d
SSDEEP

384:E3eVES+/xwGkRKJ8ElM61qmTTMVF9/q5H0:bGS+ZfbJ8EO8qYoAU

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
544	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2952	ipconfig.exe
2904	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	tasklist.exe
Token: SeDebugPrivilege	2904	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe
2440	104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2144	2440	104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe	29
PID 2440 wrote to memory of 2144	2440	104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe	29
PID 2440 wrote to memory of 2144	2440	104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe	29
PID 2440 wrote to memory of 2144	2440	104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe	29
PID 2144 wrote to memory of 1704	2144	cmd.exe	31
PID 2144 wrote to memory of 1704	2144	cmd.exe	31
PID 2144 wrote to memory of 1704	2144	cmd.exe	31
PID 2144 wrote to memory of 1704	2144	cmd.exe	31
PID 2144 wrote to memory of 2952	2144	cmd.exe	32
PID 2144 wrote to memory of 2952	2144	cmd.exe	32
PID 2144 wrote to memory of 2952	2144	cmd.exe	32
PID 2144 wrote to memory of 2952	2144	cmd.exe	32
PID 2144 wrote to memory of 544	2144	cmd.exe	33
PID 2144 wrote to memory of 544	2144	cmd.exe	33
PID 2144 wrote to memory of 544	2144	cmd.exe	33
PID 2144 wrote to memory of 544	2144	cmd.exe	33
PID 2144 wrote to memory of 2472	2144	cmd.exe	35
PID 2144 wrote to memory of 2472	2144	cmd.exe	35
PID 2144 wrote to memory of 2472	2144	cmd.exe	35
PID 2144 wrote to memory of 2472	2144	cmd.exe	35
PID 2472 wrote to memory of 2932	2472	net.exe	36
PID 2472 wrote to memory of 2932	2472	net.exe	36
PID 2472 wrote to memory of 2932	2472	net.exe	36
PID 2472 wrote to memory of 2932	2472	net.exe	36
PID 2144 wrote to memory of 2904	2144	cmd.exe	37
PID 2144 wrote to memory of 2904	2144	cmd.exe	37
PID 2144 wrote to memory of 2904	2144	cmd.exe	37
PID 2144 wrote to memory of 2904	2144	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\104430c923522d90dd9e3fc15df6d950_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2952
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:544
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      System Location Discovery: System Language Discovery
      PID:2932
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
892b07c6de5515dae655b61534b3e4c0

SHA1
5c353558ff39e566b08089b4789eb12e31aa2c6b

SHA256
750c9f4096a0bab0b473926bfccd41e0281dc759dff63c2c17b33ca2e5c2e10d

SHA512
1a922adc681c46ac1fb045f950b49562465aa9602edb582177393fc3b5078c80f82181f93bae9427918bfa241d6fa1b97af0f8da9824c564c31669a9c2ae3efc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads