c000ae90dbec3dabe17d1556a8b636d051d99fde25b9af1089e6435735a485ae

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1141bd006aee55bfbdfe770252ebb007_JaffaCakes118.exe
Size

127KB
MD5

1141bd006aee55bfbdfe770252ebb007
SHA1

f1d4f8a7b9d1b0c0824efe80baafd7aaf8a9e728
SHA256

c000ae90dbec3dabe17d1556a8b636d051d99fde25b9af1089e6435735a485ae
SHA512

0ab032cbcb7535ef69f75653e1b7844b0d4b8bad84644833942431b9358d9d67676abbafa9d0235b945ad485156ae1326b0fff1d42d0dcc6572d5d3e1ec6c164
SSDEEP

1536://zYNeLN9iECnLTkzZRVkS+E8O0Nxu/7oKslhxtTUzM+SEusRG1uDVBf7KCtbVrq:z9ODHkzZjoVffQSEuZeVt7KG2ZR3cW

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2544	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1141bd006aee55bfbdfe770252ebb007_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2544	1860	1141bd006aee55bfbdfe770252ebb007_JaffaCakes118.exe	30
PID 1860 wrote to memory of 2544	1860	1141bd006aee55bfbdfe770252ebb007_JaffaCakes118.exe	30
PID 1860 wrote to memory of 2544	1860	1141bd006aee55bfbdfe770252ebb007_JaffaCakes118.exe	30
PID 1860 wrote to memory of 2544	1860	1141bd006aee55bfbdfe770252ebb007_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\1141bd006aee55bfbdfe770252ebb007_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1141bd006aee55bfbdfe770252ebb007_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wbz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wbz..bat

Filesize
238B

MD5
746e6a1c11a2ba6e36d18a7d9146ebda

SHA1
9c8040e06b0daae5031b5cfb300fd824ae316c42

SHA256
747d16f50baaea665f063af5087fba7c925e0ad4b1eba99c36f0ad13d9375f4f

SHA512
eaf93e84c5d91f60af1c99e5a3625d408e1b8ba15fa04135814297c039fa3985913d7492a265c814dd040d2fc5a1806c43c698c7ef262d0a93b656f27a635b39

Download Submit
memory/1860-0-0x0000000000250000-0x000000000027D000-memory.dmp

Filesize
180KB

Download
memory/1860-1-0x0000000000250000-0x000000000027D000-memory.dmp

Filesize
180KB

Download
memory/1860-2-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1860-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download