6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
29/07/2024, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe
Size 3.0MB
Sample240729-ye3dmaxarp
SHA256 6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9
MD5 5be84affded6a459de10d6490bc42f25
SHA1 c901557593506294588fe36e85fcb0de94b71778
SHA512 92b7b930aed7b6df7d71d76e404be566f0fccdf507f048cccebfc9d78a14e8086fc05900d88438bcb7527aec96651cbef1c8cec7cccfee71dd1cdbbb741d9ff1
SSDEEP 49152:IARVS4nHwHHzaG0fuEqhfzJ3LKjcniRSVSHo8Vnt9/URlWbEc+YV48GbjMQHaX82:IYPnQHTa3uJ3LKYvVSHoA9/WlWbEyC8X
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4740	5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe
4740	5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe
4740	5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5be84affded6a459de10d6490bc42f25_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb954D.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Processes.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb954D.tmp\Processes.dll
Size 56KB
SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
MD5 cc0bd4f5a79107633084471dbd4af796
SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
SSDEEP 768:WmswCIbuzwEmd7Fp4KpDAKngV9tV3rJy63JgaVwoz7si4uYqUYWu1gYwmj552RFB:WmswCIbuzwEy7n3YD3Jgw7shKrp55io
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsb954D.tmp\ioSpecial.ini
Size 749B
SHA256 06ca4eb762c4419ac87611c1dfed7c9daf48f33ba369f8638eb0bc946421e9f6
MD5 e91d71d93c511f998fc628cebdf53008
SHA1 7600f35647f10ed410b1b991843c2cf9d30b6962
SHA512 8110c5430cfce465c5dc739c139dce981b9334d42b5386ce956b0cd51275e8c135a885ee083b0f833d5d047ff952f4c5260ef797d594c1134ef29ebd54ffc435
MD5 SHA1 SHA512

Submit Download