fe4b7570a04c0109f426bcb2b4d474162dade55b2b25bda8296f3112b914c961

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe
Size

76KB
MD5

549a41de430fe58e3ebc36155de0db80
SHA1

1504a47206a3e517938c81fb59eeb64c3073e435
SHA256

fe4b7570a04c0109f426bcb2b4d474162dade55b2b25bda8296f3112b914c961
SHA512

c12620de3f595b18aa94629fb0b37a0dcdd43c28d00794b591620614bacd802a083ac8163d46e9084bfb373fa7748e0a849994b801e7203c47adffa4a6fbcf38
SSDEEP

768:ZXldqUSJ3u1NuNNJj8e8+xO/2ErQ+vnMeokYfOsYi9dJ7yZTFyHA+E23zNdoTAWb:Z+TuSNNF8xFBkenNsY4KFyH33z/VWk4

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2652	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2156	System32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System32.exe	549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\System32.exe	549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	System32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	System32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2200	549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe
2156	System32.exe
2200	549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2200	549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2652	2200	549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe	31
PID 2200 wrote to memory of 2652	2200	549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe	31
PID 2200 wrote to memory of 2652	2200	549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe	31
PID 2200 wrote to memory of 2652	2200	549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\549a41de430fe58e3ebc36155de0db80_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\549A41~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2652

C:\Windows\SysWOW64\System32.exe
C:\Windows\SysWOW64\System32.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\System32.exe

Filesize
76KB

MD5
549a41de430fe58e3ebc36155de0db80

SHA1
1504a47206a3e517938c81fb59eeb64c3073e435

SHA256
fe4b7570a04c0109f426bcb2b4d474162dade55b2b25bda8296f3112b914c961

SHA512
c12620de3f595b18aa94629fb0b37a0dcdd43c28d00794b591620614bacd802a083ac8163d46e9084bfb373fa7748e0a849994b801e7203c47adffa4a6fbcf38

Download Submit