b5492b4cf52a5c13ef97b8f1a2d8fa5d1c92df42f2aca7c70f82d73a914abf9e

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

75dcb3a88b0e279a022ea9bb95775b7a_JaffaCakes118.exe
Size

4.9MB
MD5

75dcb3a88b0e279a022ea9bb95775b7a
SHA1

5da2f12c20cd8cf5a5422096c856a1a1cda0cf8b
SHA256

b5492b4cf52a5c13ef97b8f1a2d8fa5d1c92df42f2aca7c70f82d73a914abf9e
SHA512

73790a7e928697babdf62761352117e8ea666430e28aec4a7ef8d799b208c45c0bd2c434c9f7101fbbe5f305bf488ef2b036920e963710beffc3680b4be49f7b
SSDEEP

98304:SfpxMefQfDXKl0e+MB1VQidUrIidaLWSWhlK7KPru8kafe1V3+YM9YE:+t4awqVLKZZuRa4wpYE

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2052	75dcb3a88b0e279a022ea9bb95775b7a_JaffaCakes118.exe
2052	75dcb3a88b0e279a022ea9bb95775b7a_JaffaCakes118.exe
2052	75dcb3a88b0e279a022ea9bb95775b7a_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	75dcb3a88b0e279a022ea9bb95775b7a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75dcb3a88b0e279a022ea9bb95775b7a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\75dcb3a88b0e279a022ea9bb95775b7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\75dcb3a88b0e279a022ea9bb95775b7a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GLCC3AD.tmp

Filesize
161KB

MD5
09e59d00df5d2effd8dd9b30385cb9d2

SHA1
0fa0d3f6692f31fdabefb719b0f7a28cbf5d5415

SHA256
1c574eab5e83ccfe5a0bb7b59e028cc5fa2f4e77868051e305d83c709711ff77

SHA512
d73e3832777341a4176dbd9988002ec94a32f162492e869a8c03d9bb10f1833821f99e15710e9fc103a2820c862cf14a0b990d7c7c09150bb14618a7c93ca5fd

Download Submit
\Users\Admin\AppData\Local\Temp\GLFC891.tmp

Filesize
10KB

MD5
9da8f742593d4bbca708b90725282ae2

SHA1
9aaa6ed98726e657252a098f2bf06066a8604d27

SHA256
e362a9815527869e0f71fdf766a1c3648e307145defda7a5279914e522bcb57c

SHA512
f8b4129dc4ab30e009cb4db8a80f06b16306c1a90a49e534befb925d6ce4d5713b98553a2107b40efa8b5abd025ff0556976cf46c3642ce8e372c34d105e36cb

Download Submit
\Users\Admin\AppData\Local\Temp\GLKC3EC.tmp

Filesize
33KB

MD5
517419cae37f6c78c80f9b7d0fbb8661

SHA1
a9e419f3d9ef589522556e0920c84fe37a548873

SHA256
bfe7e013cfb85e78b994d3ad34eca08286494a835cb85f1d7bced3df6fe93a11

SHA512
5046565443cf463b6fa4d2d5868879efc6a9db969bf05e3c80725b99bd091ce062cfe66c5551eb1cc5f00a38f2cfcda1f36fb4d60d9ff816c4ec3107b5a0df40

Download Submit