Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 20:53

General

  • Target

    75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe

  • Size

    7.9MB

  • MD5

    75ae56b379d6244f8b52d1fabc8ec2e8

  • SHA1

    ba0000b186ac6cb1921d3663c0dc96b73fc27665

  • SHA256

    d520316b0a826549ea56d37c6518ce869426b19e69541acbff157803c88a58c7

  • SHA512

    9682bb8634e9b4bd0f9ef65447d907fa825e57fe485926c7fb78fffd5b4510a8c90558c29d97c24ca977e7064a1ecb2ba62b60ac5d8e11732ab2e5c3e83b913d

  • SSDEEP

    196608:xo/owZET0hisUobMalDYj6Coej1WgpFps/XjMKT:2/owZETairobplDw/fhs/Xww

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2096

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nstA9B8.tmp\ioSpecial.ini

    Filesize

    720B

    MD5

    a41305c48f7b1da9f09d8bd073381de1

    SHA1

    66242e237a8bfde9983411c9249e2ef761fd4dac

    SHA256

    8161b30db77eb3c8d723509270b18814e3d7d12318ca1ffdc3d0dceb73e655dc

    SHA512

    1abb35c8044cfc4f2a447b4da4cf3849601bc7200d9a33976c59ede6133ce97f1973579f884fdda6803e049b5d52dee5ffb9f11ce7bf209c56708fa4421a1614

  • \Users\Admin\AppData\Local\Temp\nstA9B8.tmp\InstallOptions.dll

    Filesize

    12KB

    MD5

    4c7d97d0786ff08b20d0e8315b5fc3cb

    SHA1

    bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c

    SHA256

    75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84

    SHA512

    f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a

  • \Users\Admin\AppData\Local\Temp\nstA9B8.tmp\System.dll

    Filesize

    9KB

    MD5

    e085476805e8f5ef1c7ed635c5309017

    SHA1

    609e79fdc29d6dee40cc5dd333094db5f9f63eec

    SHA256

    4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

    SHA512

    082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f