5a2fdd343aca013c116da6349d253ffa566724716d4802fb3fe9905d283afc66

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 05:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a9bccabe2aa460e6bfabb077a3fef340_JaffaCakes118.exe
Size

126KB
MD5

a9bccabe2aa460e6bfabb077a3fef340
SHA1

d18265805750e228ae02b8d23a3d09b586cf2c2d
SHA256

5a2fdd343aca013c116da6349d253ffa566724716d4802fb3fe9905d283afc66
SHA512

5111a207472b963852d017fc44ea99f5ad2636d46ba34fbe24ad8c73e561ae1a7cc32a0a548b1e6e994d5fc9490221f2feab21c257559da318a725a395f6f4ce
SSDEEP

1536:QYTmwVUsW7dtJMHy0DxmJG4Romu/HUN3r79y05RKDG3wDfG+bU1VC3cmpoByARDk:TS17XJiDxmJG455N7A08S2dg18qjdbxA

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2516	a9bccabe2aa460e6bfabb077a3fef340_JaffaCakes118.exe
2516	a9bccabe2aa460e6bfabb077a3fef340_JaffaCakes118.exe
2516	a9bccabe2aa460e6bfabb077a3fef340_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9bccabe2aa460e6bfabb077a3fef340_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a9bccabe2aa460e6bfabb077a3fef340_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a9bccabe2aa460e6bfabb077a3fef340_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsn8CD0.tmp\NSISdl.dll

Filesize
37KB

MD5
ab3f88124e6a470b5c6f5730b6e54cd3

SHA1
68a0cce70c060d262e0e1bb33e959e10e937ac8f

SHA256
1aaeb335136cfe7011c3a1122fa1339e0fd94263be18b2d61917c85ad5497e69

SHA512
3857d26f9ec79a4c5a544fb8bffe8613f29e1ed5983a8b018ff8c757adee8a944eec5092560cd72d5d99366dc7fd7d2aa197ee3249f6542c433028befb9d3acc

Download Submit