Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 00:37

General

  • Target

    b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe

  • Size

    333KB

  • MD5

    b9b07066e266e04d377f96b55967a1f6

  • SHA1

    1261b6b6aa15787c64c15247f245f2334bb4fab5

  • SHA256

    abfda8ae99688153ce446924a7fa3b0c777ba866ed867547ed1b9c59d9df131b

  • SHA512

    7cd64ed20654877dfb9c87cdba6f77734ecaef6516deb74768368045a3a54c17210ac322e969a7fbe39f86a132aea6775f36429f83e7196fe3c70846fc448115

  • SSDEEP

    6144:Me34DouTmByUhpdaRNzObYmmObsKla/URyzHB1H6tjm2/Wn9EzEpLu2UC:NLB9daRAbYmmw8URsBJUb/W9EzoT

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsyB7DB.tmp\ioSpecial.ini

    Filesize

    688B

    MD5

    e5ea196761ae92f157d66a1ac74e7dfb

    SHA1

    30be3bcbcec76555b207c765b909db2c01a6bea0

    SHA256

    c57c279c946365fbe28a8917c2fa2c1e9b7352e2e73777b136498e62b150f899

    SHA512

    f6973de746e5e4b2f1b0e711ad14298155d2520fa0ed0a3a8ce3b81b2c890a9fac4f999bc037494e5d4ed3693c1b6ecf2d92af5b259779b4a393df960dbbb063

  • \Users\Admin\AppData\Local\Temp\nsyB7DB.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf