d289f3a3fe7b6fd2281cac5c09309b65059fead3866d08a7cd77a3e4be885f51

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

275aa6c442658562401f6d0fde048e90_JaffaCakes118.exe
Size

93KB
MD5

275aa6c442658562401f6d0fde048e90
SHA1

6a471d7e3c7adb74192c7a562c1c116e7fffc578
SHA256

d289f3a3fe7b6fd2281cac5c09309b65059fead3866d08a7cd77a3e4be885f51
SHA512

ad8746b96e8c6df143faa1022b7fa649d77d71aea1ffedc11aed387396e14834242f00a2dc7a918082dfcb21126b6efbb0600265624277bdefd1df0bf6d26a4e
SSDEEP

1536:OmGCGKcXpUwbTZ2m0issAmGvyYT6HCBvO1rM+kS2PCqEgJMc3kdkMMckgQom5+X9:DGDZvbd2XnstG6YT6iqA+kPCq/JMclMV

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2544	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	275aa6c442658562401f6d0fde048e90_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2544	1908	275aa6c442658562401f6d0fde048e90_JaffaCakes118.exe	30
PID 1908 wrote to memory of 2544	1908	275aa6c442658562401f6d0fde048e90_JaffaCakes118.exe	30
PID 1908 wrote to memory of 2544	1908	275aa6c442658562401f6d0fde048e90_JaffaCakes118.exe	30
PID 1908 wrote to memory of 2544	1908	275aa6c442658562401f6d0fde048e90_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\275aa6c442658562401f6d0fde048e90_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\275aa6c442658562401f6d0fde048e90_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Fjz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Fjz..bat

Filesize
238B

MD5
e5149e9eda0a6881af68484f7b585076

SHA1
4ecfea091e0b96712f168e7e5aaf634956f81920

SHA256
52b3b51302a4183a571edd58ef333bea33039b9690089ed2017d4e5b00d88473

SHA512
821277cd0a5a7eecb8388845ee7dd5b44bffd944b1780558ed1a4470aa5ebac1d39f3ac9f75584efe10af68f4aad40e43145c6c5660e60fa37728c25f7c3be9d

Download Submit
memory/1908-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1908-0-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/1908-1-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1908-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1908-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1908-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download