c68464d9a8146e06ca9cedaf86a650046fe21236bb43f5b36ef30b1ea0f20a81

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
Size

771KB
MD5

3f43485292fd9371f5c50e8e1c24ae2b
SHA1

819f00a0646d28eba86f0e811b55da7c6ff59b41
SHA256

c68464d9a8146e06ca9cedaf86a650046fe21236bb43f5b36ef30b1ea0f20a81
SHA512

de7609a5d607417849345cfbd686477ee6d6d1f2f696fd39ed5497fd9eeaff1909d82543341d0c025cd54167c79e991e897fdf13c51130e33519c17bbe44c1f5
SSDEEP

24576:vZX/MbxR7RFghfqyb10hJaothZ2/T6FBBB:hMNFfgNh/ofT

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3052	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3052	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1936	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1936	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1936	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
3052	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3052	1936	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe	30
PID 1936 wrote to memory of 3052	1936	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe	30
PID 1936 wrote to memory of 3052	1936	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe	30
PID 1936 wrote to memory of 3052	1936	3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\3f43485292fd9371f5c50e8e1c24ae2b_JaffaCakes118.exe

Filesize
771KB

MD5
dc262060e141390090187e25c9a39993

SHA1
04c439ac1e6ff794b397f47cceed1233640816a1

SHA256
091bfa487faf415d4e8da0e144ce1905df061bb775f32f4443c45b380367ff91

SHA512
8687f93a4e002765fc7039ef38fb0664b7b879769d988d673b9f5fcb418f9348c3dccc7a20f441a456ae55417a91391cef617040f2809d6f90cc0e6815921614

Download Submit
memory/1936-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1936-1-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/1936-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1936-14-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3052-16-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3052-17-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/3052-23-0x0000000001470000-0x00000000014CF000-memory.dmp

Filesize
380KB

Download
memory/3052-24-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3052-49-0x00000000043F0000-0x000000000442C000-memory.dmp

Filesize
240KB

Download
memory/3052-48-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3052-43-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download