fafc6c80117a82cbeb7d666c57665f17a6c0fb45d7e4049f20e208eed9bb9cd8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c16036545803321b48213298b9541254_JaffaCakes118.exe
Size

127KB
MD5

c16036545803321b48213298b9541254
SHA1

1e76bb25e34b1a337979695df7fbd0cf5a277d1c
SHA256

fafc6c80117a82cbeb7d666c57665f17a6c0fb45d7e4049f20e208eed9bb9cd8
SHA512

8cf2cd13d4b84489a9e45bd7ee17e183580e78b8f500b555abb16bf84f7562ece20008d89b1183bd790de67fc31f3e882c314b23f8fa8abd86358bb299a20012
SSDEEP

3072:u+m1hcp6RL458+qD+T1LvY5KtiFWKzzFaw8cGw:u+m1epwTzkz8FW6vbt

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2572	c16036545803321b48213298b9541254_JaffaCakes118.exe
2572	c16036545803321b48213298b9541254_JaffaCakes118.exe
2572	c16036545803321b48213298b9541254_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c16036545803321b48213298b9541254_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c16036545803321b48213298b9541254_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c16036545803321b48213298b9541254_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd9010.tmp\NSISdl.dll

Filesize
37KB

MD5
491918a8925a32d5090f259bc14d8f04

SHA1
9e9a282e9c0c5dbdaf3762314450156b9b7ed565

SHA256
27fd61c4ffa7d6791e32cba030457540138ada91e06fa24e7040c5a42c5fa22f

SHA512
131b391065f575e3ee370d7096aff6d9825ee9f4ec37b413506f59f66acfe09f68f53ff3eb47ac62fb8575a76165833ff293ffe462f280453070161fa928558f

Download Submit
memory/2572-15-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download