49a040b765f39a42f5e11b79e58176a9f64683369cd8c13945415cc098aff2b9

Analysis

max time kernel
138s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

83aa36a2355c44cf6fff9301b6fd53f4_JaffaCakes118.exe
Size

117KB
MD5

83aa36a2355c44cf6fff9301b6fd53f4
SHA1

098b92522fc523bbdadc53f071be9bdff8f4d648
SHA256

49a040b765f39a42f5e11b79e58176a9f64683369cd8c13945415cc098aff2b9
SHA512

36a2f2b08b5fc4c172d1f87afdd1d5a5fa4cce6872a35e5733744dac19d8e056f988901beb97c92e1e978c8657aa145ad44e66bce3f73bd63837289084892332
SSDEEP

3072:+80IwJxDieMR2F6hDmxLtT10TvIZ71gt1kI54:+VYR28hmddeLIvCpK

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
1476	83aa36a2355c44cf6fff9301b6fd53f4_JaffaCakes118.exe
1476	83aa36a2355c44cf6fff9301b6fd53f4_JaffaCakes118.exe
1476	83aa36a2355c44cf6fff9301b6fd53f4_JaffaCakes118.exe
1476	83aa36a2355c44cf6fff9301b6fd53f4_JaffaCakes118.exe
1476	83aa36a2355c44cf6fff9301b6fd53f4_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83aa36a2355c44cf6fff9301b6fd53f4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\83aa36a2355c44cf6fff9301b6fd53f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\83aa36a2355c44cf6fff9301b6fd53f4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gentee00\gentee.dll

Filesize
96KB

MD5
427d8406efd63d3ed906c565c73fd610

SHA1
58b4d079e9e672cdf3bd234a15ee23d0f6393b86

SHA256
916a58e9bd8327792e4fdb83d4439536ce88ddc3a6cdc69cae579af7088078dd

SHA512
9ba70be20367295c9187e8419d7e0e6444f821292d4e021611c1f13ff91e78f86fce285f50d793a34c34569fee225362e5232737797836d89e15aabd17f03cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\gentee00\guig.dll

Filesize
20KB

MD5
fa3db33dcefded7b4fdcb948a5e6e53e

SHA1
0adfd644e4422ffcbcfd8bfc27fcec727f04836e

SHA256
424025e13c1a624d5900f7b264145907e1092ef68e9c51d76a2648d14fdb9a17

SHA512
9be40412d7a8939a41c764058b138f1aa6fa73e0f1d2aa8c251c4e58c0cedbcf9aeee1bf669fc4347e1bccc7a9310f25ebe4731530cc5d99c64e31ef6073623a

Download Submit
C:\Users\Admin\AppData\Local\Temp\gentee00\unppmd.dll

Filesize
8KB

MD5
7b97f7a822f0f4f54c54b8ef92aaf09a

SHA1
d0916590b36d8e0507b6722449d7ffd2187498a6

SHA256
d6f3429b8ffe80e1bc023de22bc23d9b4d384d89a9b22db51aa27c804581642d

SHA512
d33c0c31df17738f0cd5384f579bacb512668ec8fec9c96e12125ffe58a38a46ac498f5924c8620a146b762fc318dd7f291efd27caaec45ca9f16d80dae05387

Download Submit