267e357c414d9845a27f842c102f7f1adbab2a6079e524dc822ae31755de285c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe
Size

385KB
MD5

3820002aed60b77a47a9e181b5c49932
SHA1

2cce8f7c9ede3d98d6ece658096f7d9aa5116a89
SHA256

267e357c414d9845a27f842c102f7f1adbab2a6079e524dc822ae31755de285c
SHA512

77c373ce839f7191a517461427e4f59bc744c286f9b8b2a639302180122e326e2ea2f70f541cccf7269fd6869c794d7fb7f95114ada7ca990e72c7ccff7a76c6
SSDEEP

12288:IaWNjjGnGyEHsxamajmJwJH3slKy3mwo4fPB:buwGH1aGclcKfPB

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2700	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2700	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2748	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2748	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2748	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe
2700	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2700	2748	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2700	2748	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2700	2748	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2700	2748	3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3820002aed60b77a47a9e181b5c49932_JaffaCakes118.exe

Filesize
385KB

MD5
4a5ec85624de692bcc94b88ec1175dd5

SHA1
024331018983f94ca5832e8e43b983bc2b9d7cf7

SHA256
d3ff6f30510435fa7c93bd262f9fd4c1c5b7aefa849d3adcc9ff2eab7ca1ea93

SHA512
64f0baa24aa2e02c33366b997b0feea22a1f465928083d279a801885430d06d11cbe57f670ca9fdf69e173576530bcbb8a567f3ee33fd7355313d0ee8a00184e

Download Submit
memory/2700-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2700-29-0x0000000000260000-0x00000000002BF000-memory.dmp

Filesize
380KB

Download
memory/2700-22-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2700-21-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2700-51-0x000000000E660000-0x000000000E69C000-memory.dmp

Filesize
240KB

Download
memory/2700-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2700-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2748-4-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2748-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2748-7-0x0000000000320000-0x0000000000386000-memory.dmp

Filesize
408KB

Download
memory/2748-14-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download