ece9aa21823a7917ed872ea70a662677910851f3090af69bcbc983020b794c96

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d39886dc4819d2c2bd7ead8500464ca8_JaffaCakes118.exe
Size

225KB
MD5

d39886dc4819d2c2bd7ead8500464ca8
SHA1

d6a3e87c78b7fee60767aea435d62164a2a09c68
SHA256

ece9aa21823a7917ed872ea70a662677910851f3090af69bcbc983020b794c96
SHA512

0f8f47defcf1a4d5d068ea2ed567b547a05e5bc8ecfc9c84c4e742561b1c9b119eecbd77e0ef1d6230a6eb7ed70935870dd6539731d5a3e92489b0ce8ca38c04
SSDEEP

6144:1sgykiIp8NhbeQTsEVRUrjLNWhOncw18dc:tykiIwbhjvUrjpQcwK

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2148	d39886dc4819d2c2bd7ead8500464ca8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d39886dc4819d2c2bd7ead8500464ca8_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2148	d39886dc4819d2c2bd7ead8500464ca8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d39886dc4819d2c2bd7ead8500464ca8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d39886dc4819d2c2bd7ead8500464ca8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsjC44B.tmp\Single_swim.ini

Filesize
2KB

MD5
0f95278944bfca2597535200a436533e

SHA1
85162099981a9a341cfcc2006e95030e361ee031

SHA256
4c8799ef553c0a77e9565b80f77bb761ed4c037c9ba62627dd4e632566816f70

SHA512
bc3237604e9fd8721abcf8f1945f22638d5aae48d11cbe1729acfccfa517514ca892eec1b33ab0be3d4e09d883c3778381a2400496513e98920cbf2da8f5b630

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjC44B.tmp\Single_swim.ini

Filesize
3KB

MD5
a5a7111c2675959e26795e85326983da

SHA1
ab40a55e4c3739f98784839d864587c22c8ec1cf

SHA256
3fc22ae5a6a77fcb088e56cf952328e983102620294ce29be6f501286217a331

SHA512
9acd10efd7d062fae41674e49eab3b2c861c03a3f023269927c7180dcf1ec0ea677210e68c83eab5c60e95c67f8f80657fc5882c6ad8305ae7aa95de438510f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjC44B.tmp\Single_swim.ini

Filesize
2KB

MD5
8bbe17dbe940e00864b10f357e38973e

SHA1
e9b982b7915394ead0e762801fa59fb4ffc10721

SHA256
db517963438de72182f7a9986fe90b9dfa5caae2a5e5f997d94204e60c2eb346

SHA512
beee4dca78f4eed135d043e1f8bb279408cdc8888d0a5635d28362b3eacadaa52b3c7244c41e45ee2de8bfa1980410cf4567b871658694ab4b9047f3b68c1eb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjC44B.tmp\Single_swim.ini

Filesize
2KB

MD5
49bee491eaf3bf5089333a3309421e1c

SHA1
037d405a7e6fe997ed405d043d5defb85622f0f6

SHA256
a05492d12547525718872726d87af05129b45512a89079b76fc9a47d2a2d283a

SHA512
0235293130f11bc70a9cdaf177301ceb90dc471a2764c32d592aa9e33c0c1cea9778ef4cca6b2de9ebde73770b9367f2070bbb7d8d888c5814bf2cef54319cd7

Download Submit
\Users\Admin\AppData\Local\Temp\nsjC44B.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit