ea64d4b1c7523535f5481508b4cc2b6111c83bcef2eadca4db526723d3f981cb

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b943379042d93278f87a75bcbeb18371_JaffaCakes118.exe
Size

9.8MB
MD5

b943379042d93278f87a75bcbeb18371
SHA1

1ddaf6e99f90222a42f32d808a8111daa09a2348
SHA256

ea64d4b1c7523535f5481508b4cc2b6111c83bcef2eadca4db526723d3f981cb
SHA512

38e9eb0a823f3da145ac323bfabcb82a52dab0828bf896b9b1bef06366c245d9f19b87463ad54ab01df44f7af4e2d122fab1e66d0847a03bf275b2d31fb888f6
SSDEEP

196608:Fe7eULc4VjFTZ7zuUsHeCum1sIZjJiBnSfUbgN4NEJ2rY+RKR1OTc8zklYa:Fe7zLc4nTZza+n9CJitQd+n/YrOWYa

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3028	b943379042d93278f87a75bcbeb18371_JaffaCakes118.exe
3028	b943379042d93278f87a75bcbeb18371_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b943379042d93278f87a75bcbeb18371_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	b943379042d93278f87a75bcbeb18371_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b943379042d93278f87a75bcbeb18371_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b943379042d93278f87a75bcbeb18371_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst7023.tmp\ioSpecial.ini

Filesize
704B

MD5
e44148a967278e447d494d40f10a7b95

SHA1
c8ca2fa59a615f4f7bff7c92e809bf40eacf13a7

SHA256
212f7107bd533ee44f00bfa591c9f5a7303ab4dffe1cb8f9d7694561d01bbbcc

SHA512
d1f28c0d001bb86aee4f61b6fb51052945d38d5a7a9228df3245266f55f61db32c515b02870364ac53b31b389fed3bc8b80cc504027645396a159b577d8456fd

Download Submit
\Users\Admin\AppData\Local\Temp\nst7023.tmp\InstallOptions.dll

Filesize
12KB

MD5
57db62366ef11fdc47922a02031f0492

SHA1
6d30db5285b653025f94e74b9b045870dc0aeb7a

SHA256
2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4

SHA512
d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5

Download Submit
\Users\Admin\AppData\Local\Temp\nst7023.tmp\System.dll

Filesize
10KB

MD5
b21538d9f049d3e3e8b666744d7ca36d

SHA1
b97fc58f9aa238758a7574a2e32dac4e97392f47

SHA256
9dbe958fd425903ffc2197a112bec4fa597284f9637fe8fd5685016f32e21334

SHA512
05d2c660a43519fd35daa3b4310419b33e61ce8557bde55942315ca59c3b9cb9fdeaea42c403ad78a54fa9923eaa712bcf5a10dea83619a18c4ef0c451e6d533

Download Submit