0f4667df926e996aad06dc86f446d603f58b6d919f76a070dfc082545b0c3a02

Analysis

max time kernel
140s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
Size

341KB
MD5

b398ddf769eabff2fd86a997809ec587
SHA1

5b33e89cbfbae1c7583cc83a387b92e2a9b7ca27
SHA256

0f4667df926e996aad06dc86f446d603f58b6d919f76a070dfc082545b0c3a02
SHA512

05661d59353fa000758edb37738d75bedba584afbe5f65dd785c121f234903bd5cc234c64aeae32bfb0b77ccba032a4680a744189456fa0b0c03e9ee9cb8544a
SSDEEP

6144:Rtq6B4uguFT3h+G8hUAQDHyJaPq84S8EIAXtrcsvI3yk1:i6B9gYLhqnQk//Srn94oyD

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\VshieldScan.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\VshieldScan.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system\Mortal kombat V.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Crackear Windows.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Patricia Manterola Desnuda.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Carta de amor.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Paseo.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Postal Virtual.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Home Labs.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Joteando.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Fotos de Familia.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Chile puto.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Saludos.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Adan Mercader Desnudo.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Leeme.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Machos.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Patricia Manterola Desnuda.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Resentido Social.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Escuchando musica.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Leeme.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Messenger 7.0.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Sufrimiento.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Informacion importante.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Home.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Pana_infierno el Mejor.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Joteando.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Adan Mercader Desnudo.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Freddy vs Jason.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Freddy vs Jason.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Infierno.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Spiniak.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Programador.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Programador.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Estoi cagao del mate.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Joteando.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\sis639.drv	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Bin Laden.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Adan Mercader Desnudo.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Machos canal 13 desnudos.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Premio concurso.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Loretto gracias.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Pudranse en el infierno.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Resentido Social.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Outlook express hack.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Fotos de Suicidios.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Paseo.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Loteria.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Monitor.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Loretto.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Bill Gates.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Premio concurso.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Echo en Chile, Viña del Mar.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\El Tila.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\muerte para todos.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Virus [email protected]	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Hack hotmail.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Chile lindo.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Bin Laden.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Postal Virtual.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Bill Gates.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Valparaiso.pif	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Loretto gracias.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Conoscan Chile.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Hack hotmail.exe	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Hueando.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
File created	C:\Windows\system\Fotos de Familia.scr	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b398ddf769eabff2fd86a997809ec587_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\Fotos de Familia.exe

Filesize
341KB

MD5
b398ddf769eabff2fd86a997809ec587

SHA1
5b33e89cbfbae1c7583cc83a387b92e2a9b7ca27

SHA256
0f4667df926e996aad06dc86f446d603f58b6d919f76a070dfc082545b0c3a02

SHA512
05661d59353fa000758edb37738d75bedba584afbe5f65dd785c121f234903bd5cc234c64aeae32bfb0b77ccba032a4680a744189456fa0b0c03e9ee9cb8544a

Download Submit
memory/624-0-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/624-500-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/624-501-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download