e0f41333a5d401ca7ff4f07b5272abae0e96f181d0f7176ea62d0caccbef938c

Analysis

max time kernel
141s
max time network
36s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe
Size

476KB
MD5

da3966b99a53642d23b1767a56fe5bcc
SHA1

0c978e2587789a11d32daa249725d81474975266
SHA256

e0f41333a5d401ca7ff4f07b5272abae0e96f181d0f7176ea62d0caccbef938c
SHA512

88f6fb33feaac85503ae9697061d87fdf8841f559138826c33cd9e304c534ab2967eb4d4f03de78e9180a3d83df98004393d459ff102011a91e661b75f836532
SSDEEP

6144:fsehzRFBKcKbRjt9v7Vc8etHx0bdhITezYv2QaCJBA5Xpot6VfcoOvncCFjoxkPx:frMTRz+RidaaKbBEoUVSvVDyz0dDrbx

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2716	update.exe

Loads dropped DLL 4 IoCs

pid	Process
816	JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe
2716	update.exe
2716	update.exe
2716	update.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2716	816	JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe	30
PID 816 wrote to memory of 2716	816	JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe	30
PID 816 wrote to memory of 2716	816	JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe	30
PID 816 wrote to memory of 2716	816	JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe	30
PID 816 wrote to memory of 2716	816	JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe	30
PID 816 wrote to memory of 2716	816	JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe	30
PID 816 wrote to memory of 2716	816	JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\update.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\update.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\update.exe

Filesize
21KB

MD5
aa8a3b7e4d6ad2c666f848ff74a18f3b

SHA1
f0555675ab5af32a8c4c177afcb0b1e54ffd871c

SHA256
11d8aaac704cfaf1cd8cb4120afc4dd05738e9cccf65fd3be726ca9cfc4ec5c7

SHA512
ca6893513548aed5bdf7c73a89c7aa4473e34e70ad15fc4988010e557884f05e02eba2314f5bc95520b225c878a1f794aa5f60c24b28c15ceabfde5f20d60fb2

Download Submit
memory/2716-12-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads