24e5263a700dccecdf63fb049c8756413a3d7603c7c40187d3e9ca4835eae683

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe
Size

408KB
MD5

3e07b55df3ef794c23cf34194a5c81b5
SHA1

b31bf56b8b1768377163c97e22931e9b40ac5d58
SHA256

24e5263a700dccecdf63fb049c8756413a3d7603c7c40187d3e9ca4835eae683
SHA512

6913f6f6c260d8d674fa8b42857eaccf10ef5cf950ecdd5b9da35b52c969b47eceab5c98f7e81d509b6788dc36be22239679c16be650ff454014ee228093070d
SSDEEP

12288:/huZnDx8SSaijL6+70GE/Amq0XirvTg93y:Qx0jjbE4mjir

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\drivers\etc\s2er333vice9.ini	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2068	Traditional.exe

Loads dropped DLL 2 IoCs

pid	Process
2308	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe
2308	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	\??\c:\program files\Realplayer\Chinese\Traditional.exe	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Traditional.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2308	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe
2308	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe
2308	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe
2308	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe
2068	Traditional.exe
2068	Traditional.exe
2068	Traditional.exe
2068	Traditional.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2068	2308	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2068	2308	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2068	2308	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2068	2308	3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e07b55df3ef794c23cf34194a5c81b5_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- \??\c:\program files\Realplayer\Chinese\Traditional.exe
  "c:\program files\Realplayer\Chinese\Traditional.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\Realplayer\Chinese\Traditional.exe

Filesize
408KB

MD5
e28620c8ffde7221560fdd19f3ac7a22

SHA1
dbb9a803ea45d3972609d287eb071618da5acd33

SHA256
313a0605c3a0a4d37b757e138b9b6f0faf97575462c45f4a136526e6c3b99870

SHA512
9b21642f25d814cb62b4079d0a54cb7007be36748172bcde9bab96da9ee7fe7aa9fb98fa8df9af44b17ea14309097b6af8a33f33e045f2e4bc291cdcd095ad03

Download Submit