57877503b01462e0ee344b65179c291e977b858f175b5a48980a9878bd5f5e96

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
Size

213KB
MD5

16a981e8d4d8f2a8c57ff3a0aed78e84
SHA1

28430692bdded70329f1088bcba280ea3553f58d
SHA256

57877503b01462e0ee344b65179c291e977b858f175b5a48980a9878bd5f5e96
SHA512

97178052e2e14e0bc8e401995759ed87b268b6a45588c6f0e6343173eb69ff7b168555fa5ebbbecfb518aea4f26c709a03ddac7fef7bd796191a2d7f419ae702
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8YhkgnYHn:o68i3odBiTl2+TCU/xhk8Kn

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SHARE_TEMP\Icon10.ico	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon13.ico	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\bugMAKER.bat	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\winhash_up.exez	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File opened for modification	C:\Windows\winhash_up.exez	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
File created	C:\Windows\winhash_up.exe	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2652	1628	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe	31
PID 1628 wrote to memory of 2652	1628	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe	31
PID 1628 wrote to memory of 2652	1628	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe	31
PID 1628 wrote to memory of 2652	1628	16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16a981e8d4d8f2a8c57ff3a0aed78e84_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\bugMAKER.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
90B

MD5
ccd95ef297f64aa2bb41e75edc397f18

SHA1
1b680a59161b0be015acd76f5ba539fa16b28764

SHA256
57051c2b8093a45259faa904ba061c13d518101859d4a1a49d054e6f9640d481

SHA512
682bbd8fc61c6024552d77b77f5fd7b027054c0b660b8b17f5bda8efdb289d447318182dd8a54f95ee07243c12250ca3afa3e1ff08ac8c8d2f35590bf2d06c2a

Download Submit
memory/1628-67-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2652-62-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads