ac4a1df592ee598672c9599f437b75658328f2580d55a50fe60ef9727d356422

Analysis

max time kernel
131s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
Size

675KB
MD5

b56c56415a324037efb822048c20a4b0
SHA1

e885bf4e78b79b010fe30a9a901cb0ef340cfc85
SHA256

ac4a1df592ee598672c9599f437b75658328f2580d55a50fe60ef9727d356422
SHA512

b774c470e299bd1f7e684d7837322e733c9ff56b60b86520bd761a8a4bd48fe34b30fa5e249b7631dbd8c49d20da9bcd6d41ee278bfe6f868ecbef4d3adfe93c
SSDEEP

12288:ZmJuhr0boKl1TBaW7GEvJaPCh1eU47ho5EmkW6PHPCpDr3qt3Oa4Lz:ZmJLboKl1TcaGZw17uF9LKdr3+sz

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
4980	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
4980	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
4980	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
4980	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
4980	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
4980	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4980	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
4980	b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b56c56415a324037efb822048c20a4b0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst82FD.tmp\InstallOptions.dll

Filesize
15KB

MD5
6e663f1a0de94bc05d64d020da5d6f36

SHA1
c5abb0033776d6ab1f07e5b3568f7d64f90e5b04

SHA256
458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4

SHA512
2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst82FD.tmp\System.dll

Filesize
11KB

MD5
b9f430f71c7144d8ff4ab94be2785aa6

SHA1
c5c1e153caff7ad1d221a9acc8bbb831f05ccb05

SHA256
b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655

SHA512
c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst82FD.tmp\eula.ini

Filesize
1KB

MD5
5e41b8be1fe8f375a4c3081ad5959b0c

SHA1
677f85de6b2e9e2846ea987e241b47e8df05f8c1

SHA256
ae07353d8024215b422d4edc2a61f4708524b167d5673e429e332ba601dd279a

SHA512
99fdc784e1ffcf8ae45c2062aa86aeed0ad4db9bd54914800ee11ef9dbf65e98f33157481c0e04ac61a8e1050a1d1cf8074eb7126c9cb623222d9b7e57341641

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst82FD.tmp\eula.ini

Filesize
2KB

MD5
22815c32f16b985705eb153ccdb581ab

SHA1
7f36cb15c4dc102105979f5002753c3e92e27d88

SHA256
faafcb619355f3cc032beb78aa5cf58e3303398427e5b324cae73fe2de455cb8

SHA512
fcba6eb15322c8890580e8eeb35fd331d2f14ffa372ae4df6ab58f02b79e06bd98f6b10e41a01281b7f2fd1f9fd43557693c48bf1bb767b2e44965177813af74

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst82FD.tmp\eula.ini

Filesize
1KB

MD5
6a82b6a0fe6138096e549bef053ca02b

SHA1
af3bba863d0e78d85a3fc9da7ea3da1f1ff5c2c3

SHA256
974ff69ea21ffc3f5cb32db5536eed7d685120726eb6413c2040116a5016b26c

SHA512
c425cf0a340b44819ffe65a3da58f790223956d0da13a1176e6fa9f3a4a61da057b1cf2515b3cf7be8105c4f9279bec81d7589ee41373dc2d3d142289397294f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst82FD.tmp\eula_en.html

Filesize
11KB

MD5
f8aee788c2a09699cd4d607e1db670c8

SHA1
6457b766f043d901a6dd204d00626c4bea02d503

SHA256
503477569d8a48c47c4febbfd4ae6d3cb036856432c8212dcb0226580e7034c9

SHA512
424ef5a4f2653b27b3ca921c35e5e36f28c41ddfe9bcd6b5aba7968d87129826770777fbbfcdc78fce8512c1dce819be0e355282d4a729580591ff296a751162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst82FD.tmp\installhelper.dll

Filesize
127KB

MD5
91b0372096274dbd47395aa8b28ffedb

SHA1
05d79ba090439c2898d8ad480355c08091acee55

SHA256
0411ab18ecb0d3d6292eabb89b4c8e41112b3e0be272b087555c2cb8cb0bfc28

SHA512
c40b9eace25b6c871eee9b4186181268de7463c4fe1c4c19372413989489fa891ebd528175d15df031dc768613a81c619acce0981a4c29d475e795d18b1aff08

Download Submit
memory/4980-17-0x00000000024D0000-0x00000000024F3000-memory.dmp

Filesize
140KB

Download
memory/4980-163-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/4980-183-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download