49313009410afca95b49c22a00c67a9139a1aac53da221c487a60ba9d5fb7f47

Analysis

max time kernel
140s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 05:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
Size

13.5MB
MD5

c261abc8dfe938a71b4f213f54cf7654
SHA1

e91071944e9fd35b5bcab84e8a5f9329834e2152
SHA256

49313009410afca95b49c22a00c67a9139a1aac53da221c487a60ba9d5fb7f47
SHA512

0749c66d76515bca1d3097c6bd63b6283f03746f7a36ab3e40c0d2bf62af53d0f47dd5abb42e46197a86b6f9989c80bf03292087a068525399d0391ec01f2500
SSDEEP

196608:QHSB54tnobSt7H4e+Hunvh+vk9RaiFbwFZ/XjoYssVCj6LCtZ8c1NFOH5Yl0OJLu:ySTcUSpH4eSyh+Meiq/U7aCtZ/+Wlz6

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
3056	c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c261abc8dfe938a71b4f213f54cf7654_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nse77C1.tmp\DLLWaitForKillProgram.dll

Filesize
28KB

MD5
9c4b8ec42d89f7557bfd90798ce52787

SHA1
2376dde426ea65aa27c30e304086310605382475

SHA256
ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548

SHA512
17c12a27a08746755868558c037376dd7e20f03f0f71888c1329903b70975a54f57786c3c32bf88aaf30119f11ed978a6830ba91949e11cfc94fbb5ad95305b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse77C1.tmp\Dialer.dll

Filesize
3KB

MD5
a29b5c457f61822759df6f9d370292fd

SHA1
b57644f0a30e2e5d2fea790b27c21574494a8850

SHA256
c384decad4baf8c3f1dbe0e02bc7b76f11e5793ccc164b6857d8fe9eb5a9903a

SHA512
4d3651f88c655903bab97ccde0d41eec78c4cc7b6a32472c6c1531138f56359a8b13ccff698ebb4aa9e76a83c38388ddd27cac7b15a2a7b83a9cb7a4dacdba0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse77C1.tmp\FILEDownPlug120308.dll

Filesize
28KB

MD5
89c563060d908e5df6848ad15731e6d0

SHA1
404d8d41700ecc907e5b7c849a0dcde8edda1e72

SHA256
8bd1c61e9be2b8b07f6dac4782a96ee9e679c5f163133a51b57e1ecd72f3eff9

SHA512
8eb86ed92ba4d3305a954d824a1ffc23d9aef02559c794c085f67583f32d8228834b09ad45edfd8a78b4634e62344f53e1106db64134b8dd2c5e0fae391da763

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse77C1.tmp\InstallOptions.dll

Filesize
14KB

MD5
eef9e469e8a30717974499f277d97e2a

SHA1
2d33c25984ebd9116beeb55cdde4c5c86c023e5d

SHA256
1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

SHA512
d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse77C1.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse77C1.tmp\System.dll

Filesize
11KB

MD5
c6f5b9596db45ce43f14b64e0fbcf552

SHA1
665a2207a643726602dc3e845e39435868dddabc

SHA256
4b6da3f2bdb6c452fb493b98f6b7aa1171787dbd3fa2df2b3b22ccaeac88ffa0

SHA512
8faa0204f9ed2721acede285be843b5a2d7f9986841bcf3816ebc8900910afb590816c64aebd2dd845686daf825bbf9970cb4a08b20a785c7e54542eddc5b09a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse77C1.tmp\ioSpecial.ini

Filesize
666B

MD5
0577c1a39c762165d12272dd59d4d5a7

SHA1
7c84dbeb1ccf5a97786d2296fe444e724d628175

SHA256
b6f02404874ade89eb9e5f2b7493c865b02c84fd1b0a036901141367672f0a08

SHA512
b4c1a01d52782a5546d037fd14473cf2f69f8e4997994f0c46080320a296b8b90c18e736559f7161a3c3528036b1880faf639fa9b74eedaa0229f719e457121a

Download Submit