Analysis

  • max time kernel
    99s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19-08-2024 20:25

General

  • Target

    ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe

  • Size

    4.2MB

  • MD5

    ac7491531e15debeebb17a0fa830e3a5

  • SHA1

    a81d261b50d41525cc5c751fb3e5074df7754962

  • SHA256

    91b58b58645401d748ffbca177d56f705ddd981b79ff1758c7666590beaa228e

  • SHA512

    51fa2115994302af955ff06b441a803e440e3cadd95386ab523e47c59e13099b242efd64a8105f9e875efb726cd32da0f056f8c335d18fd3c18a4c060c4869c3

  • SSDEEP

    98304:RDe9IQTL3ErasIKsVwb369Qsw/XmlTfuE6JJzz62QAfQ2S:RYIM3E2sI3+b369QswelTmpjz2jArS

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsj5284.tmp\ioSpecial.ini

    Filesize

    729B

    MD5

    ceeae55bf9b342dd5cad98a73f5aaea5

    SHA1

    2e124aa4bcab3e499950ed1be27fc3295b0056bc

    SHA256

    a3174eecc10b410fbcef3be3ec3d1b9d2154e48c888a924363cc574ab2e9131b

    SHA512

    77c68db941a62eabe28dd3d21a0366b7ae63163b6128e93cd7307829045b187d7f8b5227ab85587bf3948daaec444de29103e628cf02da10ca6cf60b93b7c094

  • \Users\Admin\AppData\Local\Temp\nsj5284.tmp\InstallOptions.dll

    Filesize

    12KB

    MD5

    1d5c649dde35003a618b9679d5d71b92

    SHA1

    0409bbab3ab34f8c01289cdd847b4d1a32d05b18

    SHA256

    0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

    SHA512

    b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

  • \Users\Admin\AppData\Local\Temp\nsj5284.tmp\System.dll

    Filesize

    10KB

    MD5

    4eff5fafd746f5decb93a44e3a3d570c

    SHA1

    a11aa7681b7e2df1c7f7492a127d332d1495ea8a

    SHA256

    cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

    SHA512

    cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

  • \Users\Admin\AppData\Local\Temp\nsj5284.tmp\nsSCM.dll

    Filesize

    5KB

    MD5

    62efa7b730eb0523a026ea4325403b77

    SHA1

    806ed3bd677ccf5d9817c9b464015e347f2c8f3c

    SHA256

    0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38

    SHA512

    748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b