c2dbdf90e75290d41a10984697e53b07fbe4d0031abcc7c7748148e57896965e

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe
Size

1.2MB
MD5

162251d1d5d041acfd68a3d28bfc71f3
SHA1

a898bfdc54bf4cfa03e10f155d4c73fe05ffbfaf
SHA256

c2dbdf90e75290d41a10984697e53b07fbe4d0031abcc7c7748148e57896965e
SHA512

a6f9f94aeebe65c76d15aacc4adb4c4d51a2246563c7fe531dd384f4f89e8b3fe857b44e46ed00e2435291d80449078f64e8d27c8670323494021b70c31803f9
SSDEEP

24576:qkAwC3ZWenixkkkNVEEgeY/VhTU0oci5/WOAMVL98dyPFjK:bkJPcEFD0oDVWji+dYFjK

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2824	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp

Loads dropped DLL 4 IoCs

pid	Process
1288	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe
2824	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp
2824	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp
2824	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2824	1288	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe	29
PID 1288 wrote to memory of 2824	1288	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe	29
PID 1288 wrote to memory of 2824	1288	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe	29
PID 1288 wrote to memory of 2824	1288	162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\is-CE2BS.tmp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CE2BS.tmp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp" /SL5="$130150,955221,51712,C:\Users\Admin\AppData\Local\Temp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-CE2BS.tmp\162251d1d5d041acfd68a3d28bfc71f3_JaffaCakes118.tmp

Filesize
693KB

MD5
8043631ef861d1eb646331cf93293b1f

SHA1
6b6b031842b16c5cb51a6269fe56dd9e3ee8df7e

SHA256
21331a4a3acc8690e8c60b060f29f91705a917ace48c7c032385171ae1c2d1a8

SHA512
426c3dd1e12088484cef3c2ce75fe819cb0ae7ea4f5619110dc021493ca9fc083f9c252b928c8c565db3f779ecaba20fb655e0eaa70221b74fe3d0f7de2a01bb

Download Submit
\Users\Admin\AppData\Local\Temp\is-MLIUF.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-MLIUF.tmp\webctrl.dll

Filesize
8KB

MD5
d0372bedb70710aeff382818ad683f54

SHA1
f960deffdde9cd5cb5fd3608185a49a91d398f3e

SHA256
b3daff58c8e7ca8ce6fe155ca78c681a7d3144a538c3ed4c2913e91a1d2bd717

SHA512
4b24a990ba155b664bad58884810123898f99f3ffe3d9704662c9576d31d60f1889c7a368589af7c3c9559e5fb9921cf87bc4faf73b4b83d1262b50c9bb5f706

Download Submit
memory/1288-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1288-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1288-20-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2824-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2824-22-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download