12e2ec4b3f47131bfe2fbcf6d70e050aec6c3c31156eaf84d9d16b25b3743d5e

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe
Size

353KB
MD5

2d8c23cabf2b8f977a0fb81afc5898b3
SHA1

2de9cd4a829b31bbab5d6bbf1b0506b5e1a25f30
SHA256

12e2ec4b3f47131bfe2fbcf6d70e050aec6c3c31156eaf84d9d16b25b3743d5e
SHA512

733bead745ad83d84b3d4b390cbf2af230112ca0dfa08f823ae28aa60aded6d5a7a1059c7964f52e102ccda4e2c8d3f9d4f940d74810f496e715673b9fba3475
SSDEEP

6144:mDbUG6uRJRNWN2Bl89riCwCGBNgQ9L1QKk38hH/ygXCU8BOGkdc1kGdrlE:mDl6ENOGSrpwCWLG85GTsWkF

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2968	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2320	vistc.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ieapfltr.dat	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\vistc.exe	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\vistc.exe	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ieapfltr.dat	vistc.exe
File opened for modification	C:\Windows\SysWOW64\vistc.exe	vistc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vistc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe
Token: SeDebugPrivilege	2320	vistc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2968	2908	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe	31
PID 2908 wrote to memory of 2968	2908	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe	31
PID 2908 wrote to memory of 2968	2908	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe	31
PID 2908 wrote to memory of 2968	2908	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe	31
PID 2908 wrote to memory of 2968	2908	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe	31
PID 2908 wrote to memory of 2968	2908	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe	31
PID 2908 wrote to memory of 2968	2908	2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d8c23cabf2b8f977a0fb81afc5898b3_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2968

C:\Windows\SysWOW64\vistc.exe
C:\Windows\SysWOW64\vistc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\vistc.exe

Filesize
353KB

MD5
2d8c23cabf2b8f977a0fb81afc5898b3

SHA1
2de9cd4a829b31bbab5d6bbf1b0506b5e1a25f30

SHA256
12e2ec4b3f47131bfe2fbcf6d70e050aec6c3c31156eaf84d9d16b25b3743d5e

SHA512
733bead745ad83d84b3d4b390cbf2af230112ca0dfa08f823ae28aa60aded6d5a7a1059c7964f52e102ccda4e2c8d3f9d4f940d74810f496e715673b9fba3475

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
84606c34b3b30d79bbc2e18b53889b3d

SHA1
e6928772bf81d4b5a4d1eadaee992e1431342363

SHA256
8e258ccf21a3c259f752f49d27c0260a61da15f5a8fbd395081911d851c3841e

SHA512
bdc1edeff47e74b1ba6435c4a890898883a65ee6914c32b783ebdd369ccb5eee97bc3639be802153c7ac88b09443a167c18b735d21cb95988f368496987a92df

Download Submit
memory/2320-6-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2320-7-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2320-10-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2908-1-0x00000000004C5000-0x00000000004C7000-memory.dmp

Filesize
8KB

Download
memory/2908-0-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2908-2-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2908-11-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download