6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
29/07/2024, 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe
Size

3.0MB
MD5

5be84affded6a459de10d6490bc42f25
SHA1

c901557593506294588fe36e85fcb0de94b71778
SHA256

6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9
SHA512

92b7b930aed7b6df7d71d76e404be566f0fccdf507f048cccebfc9d78a14e8086fc05900d88438bcb7527aec96651cbef1c8cec7cccfee71dd1cdbbb741d9ff1
SSDEEP

49152:IARVS4nHwHHzaG0fuEqhfzJ3LKjcniRSVSHo8Vnt9/URlWbEc+YV48GbjMQHaX82:IYPnQHTa3uJ3LKYvVSHoA9/WlWbEyC8X

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4740	5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe
4740	5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe
4740	5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsb954D.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb954D.tmp\Processes.dll

Filesize
56KB

MD5
cc0bd4f5a79107633084471dbd4af796

SHA1
09dfcf182b1493161dec8044a5234c35ee24c43a

SHA256
3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c

SHA512
67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb954D.tmp\ioSpecial.ini

Filesize
749B

MD5
e91d71d93c511f998fc628cebdf53008

SHA1
7600f35647f10ed410b1b991843c2cf9d30b6962

SHA256
06ca4eb762c4419ac87611c1dfed7c9daf48f33ba369f8638eb0bc946421e9f6

SHA512
8110c5430cfce465c5dc739c139dce981b9334d42b5386ce956b0cd51275e8c135a885ee083b0f833d5d047ff952f4c5260ef797d594c1134ef29ebd54ffc435

Download Submit