d8a82a3f1d1ec51fa1248280eb5889faa32b96e5c370176b9616dfac47055689

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac65dc535a7327aa707cb55f5cba88fa_JaffaCakes118.exe
Size

2.5MB
MD5

ac65dc535a7327aa707cb55f5cba88fa
SHA1

8366048206755cded86122aca2d0271c074955f3
SHA256

d8a82a3f1d1ec51fa1248280eb5889faa32b96e5c370176b9616dfac47055689
SHA512

72e564e8accc37427a8abdc5bc804852b0dd91dba82b0e11ec4b191f54cdfa5168edab457358751bd30cf739f4048a00e611299cd9c3f1fe6bba15cee45afa4f
SSDEEP

49152:/xuQgXuPAsGX/VkQcYZV81hjW7OA+aTaDGyASJJMS6YAvn:6XuPIVHbZVAjW7TFGVJMS6YAvn

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
656	ac65dc535a7327aa707cb55f5cba88fa_JaffaCakes118.exe
656	ac65dc535a7327aa707cb55f5cba88fa_JaffaCakes118.exe
656	ac65dc535a7327aa707cb55f5cba88fa_JaffaCakes118.exe
656	ac65dc535a7327aa707cb55f5cba88fa_JaffaCakes118.exe
656	ac65dc535a7327aa707cb55f5cba88fa_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac65dc535a7327aa707cb55f5cba88fa_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ac65dc535a7327aa707cb55f5cba88fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac65dc535a7327aa707cb55f5cba88fa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstF680.tmp\Math.dll

Filesize
66KB

MD5
b140459077c7c39be4bef249c2f84535

SHA1
c56498241c2ddafb01961596da16d08d1b11cd35

SHA256
0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67

SHA512
fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328

Download Submit
\Users\Admin\AppData\Local\Temp\nstF680.tmp\SkinnedControls.dll

Filesize
68KB

MD5
c3e5d1a39e1f4dc8317a9e71ce93d141

SHA1
7f1e4bcfb2a6b58b5e337d58713eb27dfb2afef4

SHA256
512d67d40f6c73a8c7ce63060962b7632c47b528f340f152fbbda6ab12883579

SHA512
32b5c5439a1d58f4fcc9348d0a91ed6c4ecf5bec3abc646a345a2256060a962978a7fc9a5ce155ad1498a1d6f77dac29d433e9398252bd66b1d89875447e4603

Download Submit
\Users\Admin\AppData\Local\Temp\nstF680.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nstF680.tmp\UAC.dll

Filesize
13KB

MD5
29858669d7da388d1e62b4fd5337af12

SHA1
756b94898429a9025a04ae227f060952f1149a5f

SHA256
c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62

SHA512
6f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f

Download Submit
\Users\Admin\AppData\Local\Temp\nstF680.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/656-23-0x0000000000760000-0x0000000000774000-memory.dmp

Filesize
80KB

Download
memory/656-22-0x0000000000762000-0x0000000000763000-memory.dmp

Filesize
4KB

Download
memory/656-19-0x0000000000760000-0x0000000000774000-memory.dmp

Filesize
80KB

Download
memory/656-28-0x0000000000830000-0x000000000084A000-memory.dmp

Filesize
104KB

Download