b88e7434d6d3d22104b09246effd43939b921ad0f80bb1e359f693be0dc6ec26

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

428e980b1736338d9f2a3ac76ea789e2_JaffaCakes118.exe
Size

84KB
MD5

428e980b1736338d9f2a3ac76ea789e2
SHA1

752e69d3711a58e6ec436ad999f140fc64949919
SHA256

b88e7434d6d3d22104b09246effd43939b921ad0f80bb1e359f693be0dc6ec26
SHA512

fce1bb285fce8ebf9b3c2ede6bf4366e05f94c73e96bdc31793082cd407c55dbf167c90b337fccc7299ef0b453abd01d7d62481a7b9b3cd1e5b1499952069c1b
SSDEEP

1536:wokt4P6tUlpzwYz1KqjeOd+rNZCtLcdvj1JpKbvrX+mtK6TCoax8yK:pAbiYvj1JczOl6TCo9

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2752	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
2696	cmd.exe
2696	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\smss.exe	428e980b1736338d9f2a3ac76ea789e2_JaffaCakes118.exe
File created	C:\Windows\system32\LogFiles\smss.exe	428e980b1736338d9f2a3ac76ea789e2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	428e980b1736338d9f2a3ac76ea789e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2696	2540	428e980b1736338d9f2a3ac76ea789e2_JaffaCakes118.exe	29
PID 2540 wrote to memory of 2696	2540	428e980b1736338d9f2a3ac76ea789e2_JaffaCakes118.exe	29
PID 2540 wrote to memory of 2696	2540	428e980b1736338d9f2a3ac76ea789e2_JaffaCakes118.exe	29
PID 2540 wrote to memory of 2696	2540	428e980b1736338d9f2a3ac76ea789e2_JaffaCakes118.exe	29
PID 2696 wrote to memory of 2752	2696	cmd.exe	31
PID 2696 wrote to memory of 2752	2696	cmd.exe	31
PID 2696 wrote to memory of 2752	2696	cmd.exe	31
PID 2696 wrote to memory of 2752	2696	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\428e980b1736338d9f2a3ac76ea789e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\428e980b1736338d9f2a3ac76ea789e2_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Windows\system32\LogFiles\smss.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\LogFiles\smss.exe
    C:\Windows\system32\LogFiles\smss.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\LogFiles\smss.exe

Filesize
84KB

MD5
428e980b1736338d9f2a3ac76ea789e2

SHA1
752e69d3711a58e6ec436ad999f140fc64949919

SHA256
b88e7434d6d3d22104b09246effd43939b921ad0f80bb1e359f693be0dc6ec26

SHA512
fce1bb285fce8ebf9b3c2ede6bf4366e05f94c73e96bdc31793082cd407c55dbf167c90b337fccc7299ef0b453abd01d7d62481a7b9b3cd1e5b1499952069c1b

Download Submit
memory/2540-0-0x0000000014000000-0x000000001401D000-memory.dmp

Filesize
116KB

Download
memory/2540-13-0x0000000014000000-0x000000001401D000-memory.dmp

Filesize
116KB

Download
memory/2696-18-0x0000000014000000-0x000000001401D000-memory.dmp

Filesize
116KB

Download
memory/2696-17-0x0000000014000000-0x000000001401D000-memory.dmp

Filesize
116KB

Download
memory/2752-20-0x0000000014000000-0x000000001401D000-memory.dmp

Filesize
116KB

Download
memory/2752-21-0x0000000014000000-0x000000001401D000-memory.dmp

Filesize
116KB

Download