478afeb2beb6d36283c361a3729089e80fcd74d2c491204afcaded95828252f6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16836079159bcc50d8b1dfa1246296f6_JaffaCakes118.exe
Size

276KB
MD5

16836079159bcc50d8b1dfa1246296f6
SHA1

7c74bb9d811f8cf7c730c32f466f2c8edbbdcf86
SHA256

478afeb2beb6d36283c361a3729089e80fcd74d2c491204afcaded95828252f6
SHA512

4318ff62c92d6c2cb2ce62f8b0fdc282bc0dc6228a8911f169eec474c42ed9a4f81fa48452f864c04847cea6740f8e5be7d17ec0f74198f6017f06ed9dc53a67
SSDEEP

3072:+UfJ8XcRk4go4CDIuLgxMgIGrmeUcsTOQMOji7LuPGB5bqJfoMMVdPfV:+UfJ8XFxcLKMtG6eUJyQMOjiSo5wDsP9

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2452	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2240	sfhcao.exe

Loads dropped DLL 2 IoCs

pid	Process
2452	cmd.exe
2452	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16836079159bcc50d8b1dfa1246296f6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfhcao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2012	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2012	PING.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2452	2344	16836079159bcc50d8b1dfa1246296f6_JaffaCakes118.exe	30
PID 2344 wrote to memory of 2452	2344	16836079159bcc50d8b1dfa1246296f6_JaffaCakes118.exe	30
PID 2344 wrote to memory of 2452	2344	16836079159bcc50d8b1dfa1246296f6_JaffaCakes118.exe	30
PID 2344 wrote to memory of 2452	2344	16836079159bcc50d8b1dfa1246296f6_JaffaCakes118.exe	30
PID 2452 wrote to memory of 2240	2452	cmd.exe	32
PID 2452 wrote to memory of 2240	2452	cmd.exe	32
PID 2452 wrote to memory of 2240	2452	cmd.exe	32
PID 2452 wrote to memory of 2240	2452	cmd.exe	32
PID 2452 wrote to memory of 2012	2452	cmd.exe	33
PID 2452 wrote to memory of 2012	2452	cmd.exe	33
PID 2452 wrote to memory of 2012	2452	cmd.exe	33
PID 2452 wrote to memory of 2012	2452	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\16836079159bcc50d8b1dfa1246296f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16836079159bcc50d8b1dfa1246296f6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ngtjilb.bat
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Users\Admin\AppData\Local\Temp\sfhcao.exe
    "C:\Users\Admin\AppData\Local\Temp\sfhcao.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2240
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ngtjilb.bat

Filesize
124B

MD5
40b5a6973c5c894dee64b34ced044c10

SHA1
bbc2b7812c0d82540e442afd3493567f7d09c53b

SHA256
122da360c871f964677292a276ac552c92c8719dff5e45131d667ac9105da0d9

SHA512
372282b008fe7068119863f7747ee905a44da22dab1dcb4381d6d92634954edc92ae1a6c29d1363a42308276093f535529d5aca8efb39760cff51ccabe837607

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfhcao.exe

Filesize
184KB

MD5
7bbbdc465bb30e2cc86cec2d9e0414ca

SHA1
af5596c3f65f128d805d12e30677d40e7d4566c9

SHA256
b6896702e1c90cf44c026e68ed5b2592fdb7e7246f93d424f069358045c9c9b8

SHA512
9819f696b6d8e3cececeb37286666421a9d59b55c6e5e80f15ab67bb0d77a379a385f5c613b45fd0f6e6833070681f42a036b205be6297f226e5efa1b8a87ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vcboib.bat

Filesize
170B

MD5
afce6a8d735fb1e37e59d6cabc6c350c

SHA1
bf78bdd4d9a0a6b19fc70c2afd8d3ce67575aa38

SHA256
6051dc318bdb1277c9945dbe384b6419ce639f82b4630373414120382069d167

SHA512
53f8fab9b7fffe79d9f283be1de51b53d3ca81afdd5cff736b464c3e89f13e38cf6dd291910de40e7cc19a243376a794fe87f2b64f8e4c032190ddd61668fdb9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads