d2ec173af184b1b430301840b0af8e3f4ca27d1dfb6cb94a126774f7de004a62

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5cfc08cc9fcbd6d226ce7fda91ad7b7_JaffaCakes118.exe
Size

7.9MB
MD5

b5cfc08cc9fcbd6d226ce7fda91ad7b7
SHA1

8dac9016988dc3a5e9fad04761e94283958bcf8b
SHA256

d2ec173af184b1b430301840b0af8e3f4ca27d1dfb6cb94a126774f7de004a62
SHA512

6df78d5d85f7aa9afa45303ac7e5783f71a9469694c3c30a4c888009f053c9b2e910c1d553d0995a8ae7aed45e7167b92d4f11b07db89b90d007402ec44a5781
SSDEEP

196608:UXbiRUqcToltL0tIL0U7VLR4VjtSx7H8pOXuM+2:aiRUxTIL0SgUluoYpcuj2

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2340	b5cfc08cc9fcbd6d226ce7fda91ad7b7_JaffaCakes118.exe
2340	b5cfc08cc9fcbd6d226ce7fda91ad7b7_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	b5cfc08cc9fcbd6d226ce7fda91ad7b7_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5cfc08cc9fcbd6d226ce7fda91ad7b7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b5cfc08cc9fcbd6d226ce7fda91ad7b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b5cfc08cc9fcbd6d226ce7fda91ad7b7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GLCDEBB.tmp

Filesize
162KB

MD5
5758cb6e80bee4cda2944baa83c9701c

SHA1
b853b60e7a1cd0f8f4915444b8a3a7791ead5baf

SHA256
bb302cb17ec1abf9e78b97cf88cda4651ab754b073897966b3550bda6e044964

SHA512
92829e74d4a385c228c54c68fbe4a64fc55c0a128032aad69cf1a01e613d45958c72a190c45e9faf161278cf1df85c886734e76f1ba97a7ea84bd3fd4680e449

Download Submit
\Users\Admin\AppData\Local\Temp\GLKE0C0.tmp

Filesize
33KB

MD5
517419cae37f6c78c80f9b7d0fbb8661

SHA1
a9e419f3d9ef589522556e0920c84fe37a548873

SHA256
bfe7e013cfb85e78b994d3ad34eca08286494a835cb85f1d7bced3df6fe93a11

SHA512
5046565443cf463b6fa4d2d5868879efc6a9db969bf05e3c80725b99bd091ce062cfe66c5551eb1cc5f00a38f2cfcda1f36fb4d60d9ff816c4ec3107b5a0df40

Download Submit