1c1a956cdc8ee1599b38558b6b8b2455804b21ea13b9d894a4a8546661005f42

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6afa29dae8f342323ad4493c14d058a7_JaffaCakes118.exe
Size

589KB
MD5

6afa29dae8f342323ad4493c14d058a7
SHA1

22d3dc96318f2126c2bfc0d9e88956f35c808bb3
SHA256

1c1a956cdc8ee1599b38558b6b8b2455804b21ea13b9d894a4a8546661005f42
SHA512

a53b4682f67ef0b0059b252b4fa396fd1dffdd20bd54052f7208da42751f48310f290017f413ddc8736d5c76f2280c98819974ed4da376271253799c393b01ed
SSDEEP

12288:dB0WAaP27WdQzqpBHybWvFO+vFpfzcf01tMbCyTJ1ycmQMUPPBxe/3A2:dB0WAD7vWEmnHzCaqbpTJ4cJ3Bs3

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Company\hamza\Uninstall.ini	6afa29dae8f342323ad4493c14d058a7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6afa29dae8f342323ad4493c14d058a7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6afa29dae8f342323ad4493c14d058a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6afa29dae8f342323ad4493c14d058a7_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
93faec457bfc5dc8fbc61d2e35525559

SHA1
fcab0c0f3ba4b8452cb6eb578e0d6cb69d07cf8e

SHA256
95bec3c445480e5ba1c9cb084b7ab333bf9c987b2bdb769b0e88c860e1e3ac59

SHA512
e702b76a97b8805fe35231ccca7d82ceb93f6381d5f2184f6a5b90e736f2e64f15935662d816f17064b5af65c778779aac302894f4bfe6d018811a60174b02df

Download Submit
memory/2076-1-0x0000000000422000-0x000000000043B000-memory.dmp

Filesize
100KB

Download
memory/2076-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2076-22-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2076-23-0x0000000000422000-0x000000000043B000-memory.dmp

Filesize
100KB

Download