ac4a1df592ee598672c9599f437b75658328f2580d55a50fe60ef9727d356422

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
Size

675KB
MD5

b56c56415a324037efb822048c20a4b0
SHA1

e885bf4e78b79b010fe30a9a901cb0ef340cfc85
SHA256

ac4a1df592ee598672c9599f437b75658328f2580d55a50fe60ef9727d356422
SHA512

b774c470e299bd1f7e684d7837322e733c9ff56b60b86520bd761a8a4bd48fe34b30fa5e249b7631dbd8c49d20da9bcd6d41ee278bfe6f868ecbef4d3adfe93c
SSDEEP

12288:ZmJuhr0boKl1TBaW7GEvJaPCh1eU47ho5EmkW6PHPCpDr3qt3Oa4Lz:ZmJLboKl1TcaGZw17uF9LKdr3+sz

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2208	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
2208	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
2208	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
2208	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2208	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2208	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
2208	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy84FA.tmp\eula.ini

Filesize
1KB

MD5
036a29a838ea0296d3d0d085a45aa816

SHA1
546815f9ff1aae09d1f7295a2088ca8c261ac340

SHA256
3812e8815d2831598c5429d700f1703738eae8006022842ea6ae990f31ac0afc

SHA512
4d35332f190211338c94627170e5087430bac55c2aec16a9d1d5735279584d668b161b7c81d78cc8c1ad9c395b6ab44be8c72db7f9f321a68f1481fd6ae07910

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy84FA.tmp\eula.ini

Filesize
2KB

MD5
d10fdce7d5a2470454a622aca5d4d092

SHA1
ed16433929129b08e9c1d7caadc33b94e1d0c064

SHA256
9e32d5d4c46593526ce71cf773332b3fabfd1617d96154b42303065ef5a9cfb9

SHA512
a06124ab8341d38f8d814e7dd93f4907bb2045cbe8a592de700642d9a466499c9a598ceb98229476552768cc33a9149336ee5ed3c3bcbc5eb381d6d4884ce90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy84FA.tmp\eula.ini

Filesize
1KB

MD5
6a82b6a0fe6138096e549bef053ca02b

SHA1
af3bba863d0e78d85a3fc9da7ea3da1f1ff5c2c3

SHA256
974ff69ea21ffc3f5cb32db5536eed7d685120726eb6413c2040116a5016b26c

SHA512
c425cf0a340b44819ffe65a3da58f790223956d0da13a1176e6fa9f3a4a61da057b1cf2515b3cf7be8105c4f9279bec81d7589ee41373dc2d3d142289397294f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy84FA.tmp\eula_en.html

Filesize
11KB

MD5
f8aee788c2a09699cd4d607e1db670c8

SHA1
6457b766f043d901a6dd204d00626c4bea02d503

SHA256
503477569d8a48c47c4febbfd4ae6d3cb036856432c8212dcb0226580e7034c9

SHA512
424ef5a4f2653b27b3ca921c35e5e36f28c41ddfe9bcd6b5aba7968d87129826770777fbbfcdc78fce8512c1dce819be0e355282d4a729580591ff296a751162

Download Submit
\Users\Admin\AppData\Local\Temp\nsy84FA.tmp\InstallOptions.dll

Filesize
15KB

MD5
6e663f1a0de94bc05d64d020da5d6f36

SHA1
c5abb0033776d6ab1f07e5b3568f7d64f90e5b04

SHA256
458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4

SHA512
2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5

Download Submit
\Users\Admin\AppData\Local\Temp\nsy84FA.tmp\System.dll

Filesize
11KB

MD5
b9f430f71c7144d8ff4ab94be2785aa6

SHA1
c5c1e153caff7ad1d221a9acc8bbb831f05ccb05

SHA256
b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655

SHA512
c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099

Download Submit
\Users\Admin\AppData\Local\Temp\nsy84FA.tmp\installhelper.dll

Filesize
127KB

MD5
91b0372096274dbd47395aa8b28ffedb

SHA1
05d79ba090439c2898d8ad480355c08091acee55

SHA256
0411ab18ecb0d3d6292eabb89b4c8e41112b3e0be272b087555c2cb8cb0bfc28

SHA512
c40b9eace25b6c871eee9b4186181268de7463c4fe1c4c19372413989489fa891ebd528175d15df031dc768613a81c619acce0981a4c29d475e795d18b1aff08

Download Submit
memory/2208-15-0x0000000002C80000-0x0000000002CA3000-memory.dmp

Filesize
140KB

Download
memory/2208-158-0x0000000002D40000-0x0000000002D41000-memory.dmp

Filesize
4KB

Download
memory/2208-186-0x0000000002D40000-0x0000000002D41000-memory.dmp

Filesize
4KB

Download