e659ee86f500d360abee01ffe0eeeb4e9eae73346335f5350bc1116a948d4391

Analysis

max time kernel
80s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acbc7814cc0a98cd941e8f0c8252f491_JaffaCakes118.exe
Size

493KB
MD5

acbc7814cc0a98cd941e8f0c8252f491
SHA1

9fadf63fc9b4d118c40672d9bdbe5091d18c2b09
SHA256

e659ee86f500d360abee01ffe0eeeb4e9eae73346335f5350bc1116a948d4391
SHA512

35a731afabd58de6661ea75b508f7493af87d16e3151d99cabc8e9540a1684ca06ce49241d15ddd96ce8819bb79884eb1fd5f609b206564ece7ee8078aa29bf3
SSDEEP

3072:IJT7Wj7pppjpppzpWswppppppWGGZ9hcWm0tItFEim:b7pppjpppzpWswppppppahVBtItZm

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3036	acbc7814cc0a98cd941e8f0c8252f491_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\BASSMOD.dll	acbc7814cc0a98cd941e8f0c8252f491_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acbc7814cc0a98cd941e8f0c8252f491_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\acbc7814cc0a98cd941e8f0c8252f491_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\acbc7814cc0a98cd941e8f0c8252f491_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\BASSMOD.dll

Filesize
14KB

MD5
ccec435ed573a5c0d7fa0cf4d95f7aea

SHA1
75a1efd168d654ff58f3d584e0180d4612b85ca2

SHA256
5b4e3dc27cf787dca265f05f132516a16d7042bf2f4abdf3f7531870e71fcf29

SHA512
2a552a9c578b6d08c2bbe98d869db42425841846d2f1d67b0e4847d7765200dc7467f783d8722a4e98bc040af099be940a15b7cac157777794aadf180954e3b2

Download Submit
memory/3036-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/3036-4-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download