18aa9abc5a22bb92fa0e1bfb8d89d0fee28fe4a1e22642f8c57330e64b762bef

Analysis

max time kernel
116s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd14491a6941f22fa90e750a0fee6122_JaffaCakes118.exe
Size

267KB
MD5

dd14491a6941f22fa90e750a0fee6122
SHA1

1bdfef6956f2457456bec4e9516348427f8a12cb
SHA256

18aa9abc5a22bb92fa0e1bfb8d89d0fee28fe4a1e22642f8c57330e64b762bef
SHA512

af3edde9c3068d9261f4ca3f8756ef4fee4a3fdba65c5ccf0a610e4179362d9425e8d903707d96fe51fc1c75421113c92ab2a2fa8631e0da7b366a36430586a0
SSDEEP

6144:VPXM4kmSjw/GYjgMOGHuHyohoaiecIk/D2GzQ7kCFsFstO:VPXZbBLuHySUFIyD2cQjQstO

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1104	dd14491a6941f22fa90e750a0fee6122_JaffaCakes118.exe
1104	dd14491a6941f22fa90e750a0fee6122_JaffaCakes118.exe
1104	dd14491a6941f22fa90e750a0fee6122_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd14491a6941f22fa90e750a0fee6122_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1104	dd14491a6941f22fa90e750a0fee6122_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dd14491a6941f22fa90e750a0fee6122_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd14491a6941f22fa90e750a0fee6122_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Tsu-0450.dll

Filesize
266KB

MD5
2fc72ef07a6743b4d7e1be5b12789a9f

SHA1
88bfba6331df2f8ab0844cf39683ea9767c5f25b

SHA256
0398a1fea4326f15232fc18cf1ade170205cb2cf00189400da683f86441d2721

SHA512
160525a8edcf2d713f709adf7caa0fe76fcfb12cd1dac22f1f1e8f344c326076c38c8e5a7f46aaf7eb8ce933bc7913b4c350ff79c9cc825aa72fbee1b43b7428

Download Submit
\Users\Admin\AppData\Local\Temp\{77E0C52F-B0DF-E600-04EB-F8FDAC03E7D9}\_Setup.dll

Filesize
165KB

MD5
7ae1e518f1b449caff1dad03d4ece6c6

SHA1
eb5dfb11e6a3f6193aa6a23b40c1290ba825977d

SHA256
9e7d3ef02a8bc68ca42f51e70441458de46c3ae0d48dc9a58988eb06562097cf

SHA512
21072c0949b24611fa4f8b855b9896bb4976f025d92a27f7a3dc3878b53ff1f1067b3958dc75d075b087700fbb14a2a0a47f476dfa553d2e46941f6a63157721

Download Submit
\Users\Admin\AppData\Local\Temp\{77E0C52F-B0DF-E600-04EB-F8FDAC03E7D9}\_Setupx.dll

Filesize
28KB

MD5
856666740a759d556705602afde5a11b

SHA1
13580b41862c667c5e2db918d6b90abe6ef17270

SHA256
cb9c5c311c07c557f54a78734906c78de79404083323f307a2b0f918ea76e969

SHA512
36ad035c2e794256c6004e7445f83b47590186b2c5e47ad48229d74bdb41a6c9c4f9f5440e0424d02ba642a8bb0a2a978e4124c04c410454bf51a490ee3520b3

Download Submit