d206d5178f0393a35719f2c892881706df1da2bf89323bbd013360121eb51413

Analysis

max time kernel
78s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12bd57bc901f806544a5eb62ab1a2fca_JaffaCakes118.exe
Size

643KB
MD5

12bd57bc901f806544a5eb62ab1a2fca
SHA1

74cedf5267931a766f071797a20987442ab8a8e4
SHA256

d206d5178f0393a35719f2c892881706df1da2bf89323bbd013360121eb51413
SHA512

44c01e5e4cbfb31e8bd57193dc2a64611697d9c0a10d27493f82999e7ed4745f5cc8b4206bdc35fd45f128b5b74217c526c3c5c157704cd67f88802f94e0314f
SSDEEP

12288:MLry/neyx7f/A64j7P+tixhT8nIqqyGOpHWCxwf1wEuw:qKeyxTAJj7P+yWIVOpH3xSn

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
868	xjq.exe

Loads dropped DLL 1 IoCs

pid	Process
1040	12bd57bc901f806544a5eb62ab1a2fca_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\xwyjznmoy\xjq.exe	12bd57bc901f806544a5eb62ab1a2fca_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12bd57bc901f806544a5eb62ab1a2fca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 868	1040	12bd57bc901f806544a5eb62ab1a2fca_JaffaCakes118.exe	30
PID 1040 wrote to memory of 868	1040	12bd57bc901f806544a5eb62ab1a2fca_JaffaCakes118.exe	30
PID 1040 wrote to memory of 868	1040	12bd57bc901f806544a5eb62ab1a2fca_JaffaCakes118.exe	30
PID 1040 wrote to memory of 868	1040	12bd57bc901f806544a5eb62ab1a2fca_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\12bd57bc901f806544a5eb62ab1a2fca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\12bd57bc901f806544a5eb62ab1a2fca_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\xwyjznmoy\xjq.exe
  "C:\Program Files (x86)\xwyjznmoy\xjq.exe"
  2⤵
  - Executes dropped EXE
  PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\xwyjznmoy\xjq.exe

Filesize
658KB

MD5
9cce565324373a690afa0ce463c54cae

SHA1
d9f97893e246aeaec84d76336c66befe6896027c

SHA256
8ac4adb050f0c0dd13ecbfa370d296b9ec37c1fe794e2d831f54ed24197d4a47

SHA512
b1c0f9a29e50ea0cfcf79794f91c751019a25dc3f7858b6016fdc4de19a76bcfadc33c742c8f5b68919797aa8e771230378728b7911dbd3fad471792a3de5b0d

Download Submit
memory/868-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/868-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/868-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1040-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1040-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1040-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download