5c3b68a359891aee834f80d1d74931c72b48f766e21c9934e89c810c1d3c6ae3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1f4dbadb5339bab4d54935a21d19893_JaffaCakes118.exe
Size

3.2MB
MD5

a1f4dbadb5339bab4d54935a21d19893
SHA1

165f1ede601108feab311141b329d3373dcbcdee
SHA256

5c3b68a359891aee834f80d1d74931c72b48f766e21c9934e89c810c1d3c6ae3
SHA512

a0e112d3ab2783283335340371d258a62f26ec30a62997335224ed74e91b8c0000d70cd2932d560b395d058aa5e761d734fb2a6171a8e961b7fb6e08d43ca809
SSDEEP

98304:drtPfv+F9i39Qs4rNE/m3K275sGbqqclDR:Tf412il5stl

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2764	a1f4dbadb5339bab4d54935a21d19893_JaffaCakes118.exe
2764	a1f4dbadb5339bab4d54935a21d19893_JaffaCakes118.exe
2764	a1f4dbadb5339bab4d54935a21d19893_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	a1f4dbadb5339bab4d54935a21d19893_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1f4dbadb5339bab4d54935a21d19893_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a1f4dbadb5339bab4d54935a21d19893_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1f4dbadb5339bab4d54935a21d19893_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SpeedBitVideoDownloaderFFox.cab

Filesize
1.0MB

MD5
39d2ef7962466ea291be558ab9f438d2

SHA1
9bcfe20dcda78a2e4f0d4911e8fc6bcde4248ada

SHA256
9425d8df3f11bc5cc476bf6228e7499ea72f151d7111fa0d942c2050c2960c41

SHA512
17baa2694809269373d4885353350c5120f7e11693c1bad347c64eee6d7a00fe08de0ad8b6f475d16fa30efdbc5c54007030031b2627f0b46b62a9a362fddba5

Download Submit
\Users\Admin\AppData\Local\Temp\GLC2C10.tmp

Filesize
161KB

MD5
8c97d8bb1470c6498e47b12c5a03ce39

SHA1
15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7

SHA256
a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a

SHA512
7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

Download Submit
\Users\Admin\AppData\Local\Temp\GLK2E24.tmp

Filesize
33KB

MD5
d22557ebc659dcd0c89266e4a42a041e

SHA1
9dabf65fd4ee9d21663b2edeaab2ad8bfe6d107e

SHA256
0045a481e8f141e10927abe09b3d1608e3c123b402f8c89a7be319e088f4a0f5

SHA512
9ad08c71bd136f0a07c39226f570f8bf6abd650111c6bdc94c2708945b2757d576ce7cd6940967619dd047474e3e8e42369d103c74145555d3bc3b4396a2e0bd

Download Submit
\Users\Admin\AppData\Local\Temp\cabex.dll

Filesize
97KB

MD5
d14bfb98aba9edbbfe146e6c4a72e99a

SHA1
8778fe56b9f864485363381c2e80d4dffcba6561

SHA256
545d3f499d58f87c20a0132ba241ca6dcf11352df15ac23f9ee70981a42855d2

SHA512
ecca6fe0026a74473a88adef8ef9844c39835ad4a212e69ed75ab74a7859bf96335abab84c33f9fbe00200e113790cba782c9e8a7e1b63048fb4133e260caab8

Download Submit