d37facb5c6c22ad38c965308ed54d5ff5c453b9b56072a7b3ff9ebe3233c884c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b83d5fb19391a6b10707bc6328f5b6ab_JaffaCakes118.exe
Size

267KB
MD5

b83d5fb19391a6b10707bc6328f5b6ab
SHA1

fc12f552b352e5120cc3baab9c1b7ad0039cf770
SHA256

d37facb5c6c22ad38c965308ed54d5ff5c453b9b56072a7b3ff9ebe3233c884c
SHA512

e7d95e9c74caab7ee88600e58124cf54941466ecc9fdd43bc8e51139b83e82b5a31d2455807c55df7f53df5dcff5d40d2fac51db0701236789e237974fd5b690
SSDEEP

6144:VPXM4kmSjw/GYjgMOGHuHyohoaiecIk/D2GzQ7kCFsFstG:VPXZbBLuHySUFIyD2cQjQstG

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2852	b83d5fb19391a6b10707bc6328f5b6ab_JaffaCakes118.exe
2852	b83d5fb19391a6b10707bc6328f5b6ab_JaffaCakes118.exe
2852	b83d5fb19391a6b10707bc6328f5b6ab_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b83d5fb19391a6b10707bc6328f5b6ab_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	b83d5fb19391a6b10707bc6328f5b6ab_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b83d5fb19391a6b10707bc6328f5b6ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b83d5fb19391a6b10707bc6328f5b6ab_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Tsu-0B24.dll

Filesize
266KB

MD5
2fc72ef07a6743b4d7e1be5b12789a9f

SHA1
88bfba6331df2f8ab0844cf39683ea9767c5f25b

SHA256
0398a1fea4326f15232fc18cf1ade170205cb2cf00189400da683f86441d2721

SHA512
160525a8edcf2d713f709adf7caa0fe76fcfb12cd1dac22f1f1e8f344c326076c38c8e5a7f46aaf7eb8ce933bc7913b4c350ff79c9cc825aa72fbee1b43b7428

Download Submit
\Users\Admin\AppData\Local\Temp\{50F35A9E-3C14-F30C-11E7-74368B107868}\_Setup.dll

Filesize
165KB

MD5
7ae1e518f1b449caff1dad03d4ece6c6

SHA1
eb5dfb11e6a3f6193aa6a23b40c1290ba825977d

SHA256
9e7d3ef02a8bc68ca42f51e70441458de46c3ae0d48dc9a58988eb06562097cf

SHA512
21072c0949b24611fa4f8b855b9896bb4976f025d92a27f7a3dc3878b53ff1f1067b3958dc75d075b087700fbb14a2a0a47f476dfa553d2e46941f6a63157721

Download Submit
\Users\Admin\AppData\Local\Temp\{50F35A9E-3C14-F30C-11E7-74368B107868}\_Setupx.dll

Filesize
28KB

MD5
856666740a759d556705602afde5a11b

SHA1
13580b41862c667c5e2db918d6b90abe6ef17270

SHA256
cb9c5c311c07c557f54a78734906c78de79404083323f307a2b0f918ea76e969

SHA512
36ad035c2e794256c6004e7445f83b47590186b2c5e47ad48229d74bdb41a6c9c4f9f5440e0424d02ba642a8bb0a2a978e4124c04c410454bf51a490ee3520b3

Download Submit