6872887224bc4d6a22ca724863d0bdeb35f846d55782942f4596d44af36a7552

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe
Size

236KB
MD5

3f580e867d742fb25b4ffe3503b1b85a
SHA1

c8e958766b597eacff0080a6f71b8e8b3d08f031
SHA256

6872887224bc4d6a22ca724863d0bdeb35f846d55782942f4596d44af36a7552
SHA512

3732aa7589a32a8448da28b007fead68de70df3d68e8bcc6117dfe96a6d22948edaf300ac0012008bce64a9c57862b39c20f2829c0e278cdaebd2f8bfcb729a2
SSDEEP

3072:+fbA7uidA7AyemWvik8STpUpbQ47+CcfIyZ+cjGtHKfYp:Tdw3Wi2T2tPPEZz6Hd

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2744	WinDDK.exe

Loads dropped DLL 1 IoCs

pid	Process
2232	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDDK.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2232	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe
2744	WinDDK.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2744	2232	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe	30
PID 2232 wrote to memory of 2744	2232	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe	30
PID 2232 wrote to memory of 2744	2232	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe	30
PID 2232 wrote to memory of 2744	2232	3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f580e867d742fb25b4ffe3503b1b85a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2232
- C:\WinDDK\WinDDK.exe
  C:\WinDDK\WinDDK.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WinDDK\WinDDK.exe

Filesize
236KB

MD5
06611bcb1ddbe22b7db5ac0b84419237

SHA1
5d09d80268f372e1d1c2033253d5f4d2878bb5e8

SHA256
13892f387a2d565f1020a42dcd23862003a8760a51f22b3f1eb45323caf8683e

SHA512
a5864bb593891705008bc3b8af47ccba027363d1925bbafda61045957e2e268da0759382112362680d8b0c66af40a5b069d67db404fe5bcbac65d3fbefa76d73

Download Submit
C:\WinDDK\tmp-0.bin

Filesize
8KB

MD5
52fe4232bda48a60278960fa801a6586

SHA1
b169df7820aa3be52a4626a4e9ad9229f12faa58

SHA256
d1d1eebbf8cebfe88c5fce3e878bf31b567efbbf003187c1b3c4da2d1f37635d

SHA512
14a034d7d9bbf907cb5de9eaf55bd4eab03fd0f66364518174ba698e91255a0867371c068d44b2c9dbb705ce9f8d3d456b7651f1d96b83cccbfe5251e624bef9

Download Submit