Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/10/2024, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe
-
Size
26KB
-
MD5
260e26bd168c5c1ae85597cce0eedbc3
-
SHA1
bee6ad82b73824329ae3f7f0a007bd93440f5ec9
-
SHA256
1248a7d922544a6152de663855d20d8ca441bb3042fd9e094554908c5814d309
-
SHA512
0f6aafe78059acbd9001fd3d88a3b7f3246851d9571ecb7bf921d55e76f89694603adc2a00f02b275e7c451e4a744eeccec3b7a048fd5d00d6248168b9e7b02f
-
SSDEEP
384:kXP8CoQ9Kaonys6TpoNu26TzFXLgEHC1Ar+NGWXizaCBRwKA0lh2U:kXE+Kzys6T28Tpbs1Ar2Xi2MwK58U
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1728 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1624 NTdHcP.exe -
Loads dropped DLL 2 IoCs
pid Process 2124 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe 2124 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\NTdHcP.exe 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\NTdHcP.exe 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\NTdHcP.exe NTdHcP.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Deleteme.bat 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2124 wrote to memory of 1624 2124 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe 28 PID 2124 wrote to memory of 1624 2124 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe 28 PID 2124 wrote to memory of 1624 2124 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe 28 PID 2124 wrote to memory of 1624 2124 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe 28 PID 2124 wrote to memory of 1728 2124 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe 29 PID 2124 wrote to memory of 1728 2124 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe 29 PID 2124 wrote to memory of 1728 2124 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe 29 PID 2124 wrote to memory of 1728 2124 260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\260e26bd168c5c1ae85597cce0eedbc3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\NTdHcP.exeC:\Windows\system32\NTdHcP.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1624
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\Deleteme.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5e6d37210bc4957ef81c45f6c5f319feb
SHA16322532a89448784ed897b2c05181b0fa6437c65
SHA25655bc10377c4d25d7e96a8af60046c531b8a063e06f0a9e4190165b97ef81251c
SHA51231fedf0337b1d157f306e80c39bac1a9a6836ea0b87b5b9b123271f04ab6e481243e8197581ea720c1a190b7b1bc50d18d4b9d87d4c6346ede4571e4e2765328
-
Filesize
26KB
MD5260e26bd168c5c1ae85597cce0eedbc3
SHA1bee6ad82b73824329ae3f7f0a007bd93440f5ec9
SHA2561248a7d922544a6152de663855d20d8ca441bb3042fd9e094554908c5814d309
SHA5120f6aafe78059acbd9001fd3d88a3b7f3246851d9571ecb7bf921d55e76f89694603adc2a00f02b275e7c451e4a744eeccec3b7a048fd5d00d6248168b9e7b02f