e9d67a2e057ca30600aa7c21e7026844238265755fc03f78a4fb78f7d0e48883

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ff13035510edafddf1fb04f55b48184_JaffaCakes118.exe
Size

6.1MB
MD5

9ff13035510edafddf1fb04f55b48184
SHA1

1aaf743606b7096274926cc38f2bd8cf97314d0e
SHA256

e9d67a2e057ca30600aa7c21e7026844238265755fc03f78a4fb78f7d0e48883
SHA512

206ebbe2a667d694b170a19e0f4cb89ad3f85df027c6694716432538d1a0b881b81f4ed19afb227a3bfb2c1cd45cbd9637dd12c0a1324a19e62f2afcab18647d
SSDEEP

196608:nCdSSGO7SHT8R8s8I1d2fjHptgoQWBfjizJty:nCdSSGO7SzXs8ed2fDpCjojidty

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3616	9ff13035510edafddf1fb04f55b48184_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ff13035510edafddf1fb04f55b48184_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9ff13035510edafddf1fb04f55b48184_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9ff13035510edafddf1fb04f55b48184_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsbBBB0.tmp\InstallOptions.dll

Filesize
12KB

MD5
b3ebe1cb6bdd529302c121dd4e2e0d00

SHA1
305f022e7e3ef0ae6cdc5f18bd6adc3032f64304

SHA256
5a1696f9892567b3339faf2bf4df5eb1d2d886c49807529028b65f0f493e79b2

SHA512
6f6ea4aec1588bb6f7ab4f8422942ac0acbddb8b916af2ead039b434bec6db4d0bf64deb3b8d6cc33666cabd70024a1208411ab6e0ee10bcf98c47951f8d359a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbBBB0.tmp\ioSpecial.ini

Filesize
819B

MD5
b463bcd4f66b13a3d4483220c864ddfb

SHA1
d1586e492e4476798b50d650965fb45f1f285352

SHA256
5f2e67ae80f882f36f53cc1ec33c99c93c2ae22f25c700191dc127607b8ed7d4

SHA512
d7255473938e73d97b395d1dde4aab4c1c722670eef9ce3116b637a4e243834fc184e87959137b57ee38597f03b9bf7a2c0643d37523d5a94709de7faa102f3e

Download Submit