a4470b9d39db43538069d7d1793f037e050c1b2cf00a24f5c2f94519c3048888

Analysis

max time kernel
97s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b183b32f3ac4b3410295afb4a2f3467c_JaffaCakes118.exe
Size

144KB
MD5

b183b32f3ac4b3410295afb4a2f3467c
SHA1

9860f5aa277ac48f5f483900514875aedc8305ef
SHA256

a4470b9d39db43538069d7d1793f037e050c1b2cf00a24f5c2f94519c3048888
SHA512

181e534a366df5651f2da1e07a95329f5650fbcec9e5e41519d05b7acf1ee73a658b59e171fad36471daf46e8397a37df57851693ed617d49bd0b4f637af7430
SSDEEP

3072:iBMvzevo6jEHoIrnp/zzrTJ0iaeeDrQ1C4aaStc+1d:kMiw6HSBHrqYCvW+1d

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
3144	b183b32f3ac4b3410295afb4a2f3467c_JaffaCakes118.exe
3144	b183b32f3ac4b3410295afb4a2f3467c_JaffaCakes118.exe
3144	b183b32f3ac4b3410295afb4a2f3467c_JaffaCakes118.exe
3144	b183b32f3ac4b3410295afb4a2f3467c_JaffaCakes118.exe
3144	b183b32f3ac4b3410295afb4a2f3467c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b183b32f3ac4b3410295afb4a2f3467c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b183b32f3ac4b3410295afb4a2f3467c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b183b32f3ac4b3410295afb4a2f3467c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gentee00\gentee.dll

Filesize
96KB

MD5
52a8e86ecb39f5bb63b26d4621f8e698

SHA1
51bd9538dc02193e60a35cca499d9a737dfd4e7f

SHA256
ca48e49874eac27d5dd57878de190dd9ae7f76976e1bb095adc002e37fddc709

SHA512
198c6535cdb82420ccd069b496461fc6c9026070188a16a6914f145e8552e1d28def044dab9c2c11bd241bb5c2491c8e8f5b814906ee43db57cb1e87c728438a

Download Submit
C:\Users\Admin\AppData\Local\Temp\gentee00\guig.dll

Filesize
20KB

MD5
2eaed54cdb5fdb8e6251de8dcd4ec25a

SHA1
597d55b4c90922bfa3e32641316401ccc38bd75a

SHA256
93798ebd08698389485fc9a05a802ca8ae06033c955ed2f3728333ab7584a0ba

SHA512
a1af6506051ebf5aa89700a2430e96f6d4cff078ea5a9285a2a065349482315b4bb92c809c2021898beeb1e0e2ffb4bdb9fbc7941041664eb9e0749f00653a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\gentee00\unppmd.dll

Filesize
8KB

MD5
7b97f7a822f0f4f54c54b8ef92aaf09a

SHA1
d0916590b36d8e0507b6722449d7ffd2187498a6

SHA256
d6f3429b8ffe80e1bc023de22bc23d9b4d384d89a9b22db51aa27c804581642d

SHA512
d33c0c31df17738f0cd5384f579bacb512668ec8fec9c96e12125ffe58a38a46ac498f5924c8620a146b762fc318dd7f291efd27caaec45ca9f16d80dae05387

Download Submit