292826153076ed8400acdf93ae20a760c78980dbc9671fce02c61e7336edf900

Analysis

max time kernel
101s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a11e60af1c2434687d1a74f6dbfa5b18_JaffaCakes118.exe
Size

198KB
MD5

a11e60af1c2434687d1a74f6dbfa5b18
SHA1

1ee1da0370d7f9d08aefee4fa39c4f18ca0cd7cb
SHA256

292826153076ed8400acdf93ae20a760c78980dbc9671fce02c61e7336edf900
SHA512

216eccace0d98933ef791d37bbc55099cc53ebdc52db10b54c66353bc935315248bc7db68331becb8e0cd99145c5f294734111fc5eb8d815b75e4ba05755efcc
SSDEEP

3072:/gXdZt9P6D3XJEJuqguI45awDc6EwPBRhgC09hiDFuYqTy7uoQk+fBRpE9:/e34mgtuV5a9CBP0HkBTBQnBi

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2240	a11e60af1c2434687d1a74f6dbfa5b18_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a11e60af1c2434687d1a74f6dbfa5b18_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	a11e60af1c2434687d1a74f6dbfa5b18_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a11e60af1c2434687d1a74f6dbfa5b18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a11e60af1c2434687d1a74f6dbfa5b18_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nseF5D.tmp\ioSpecial.ini

Filesize
643B

MD5
3a3295f3a36bbe2a5b404edfc8793518

SHA1
67eefe76150633da9a9a387236cd904ad50addce

SHA256
939f6418c6c399ff8ce0fc7034793840269e4698c3bdeceface360dcdc86ac28

SHA512
3899adfb52b710c0cead04fd1d3621d4765c7cf95052e2bbcf88d2ae2b396f9100b256727f5e4d62231a47a27e5b06259b386fbfa2d7b077767d3412aaaac134

Download Submit
\Users\Admin\AppData\Local\Temp\nseF5D.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit