Analysis

  • max time kernel
    100s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    29-07-2024 19:42

General

  • Target

    5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe

  • Size

    3.0MB

  • MD5

    5be84affded6a459de10d6490bc42f25

  • SHA1

    c901557593506294588fe36e85fcb0de94b71778

  • SHA256

    6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9

  • SHA512

    92b7b930aed7b6df7d71d76e404be566f0fccdf507f048cccebfc9d78a14e8086fc05900d88438bcb7527aec96651cbef1c8cec7cccfee71dd1cdbbb741d9ff1

  • SSDEEP

    49152:IARVS4nHwHHzaG0fuEqhfzJ3LKjcniRSVSHo8Vnt9/URlWbEc+YV48GbjMQHaX82:IYPnQHTa3uJ3LKYvVSHoA9/WlWbEyC8X

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nstB00F.tmp\ioSpecial.ini

    Filesize

    723B

    MD5

    fb0d61fe5bdcd2c15291794a17a1f2d7

    SHA1

    543f0171728402fd21728ddb993e878e30af5c9b

    SHA256

    46b9a9191f97ee123729aa8467e45ec6c2f0eb7fac0306e45f5e9d32dabfd04a

    SHA512

    9888046a0205a2863fa0fe9aadcac41ec01e7f75ed502151e260defa9714044eebf884f3a24201c1b247c2bde6bea85a18162773f8cb69bbd4e335153a533510

  • \Users\Admin\AppData\Local\Temp\nstB00F.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • \Users\Admin\AppData\Local\Temp\nstB00F.tmp\Processes.dll

    Filesize

    56KB

    MD5

    cc0bd4f5a79107633084471dbd4af796

    SHA1

    09dfcf182b1493161dec8044a5234c35ee24c43a

    SHA256

    3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c

    SHA512

    67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3