051f6581fe2e82e5e0a8c7d387b75aa51911af1560570dca42bb7470d524ad1b

Analysis

max time kernel
96s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea5209468b3dc2a9f24010a7c75cc019_JaffaCakes118.exe
Size

339KB
MD5

ea5209468b3dc2a9f24010a7c75cc019
SHA1

36a2de5fe8379b77d520fb4f5d35d133e27eb68c
SHA256

051f6581fe2e82e5e0a8c7d387b75aa51911af1560570dca42bb7470d524ad1b
SHA512

d2df513a0da3d083e62bb17dbc5c189b835e630c1c2597f2db3cfe443a3d49ae61a6f5ecfbd6ed480f9c72ebb059724c8eb99bebf82865dc241a95dcda117f85
SSDEEP

6144:9bUTp1WPeryXlpnt8Q+KaVM+eB6KEzRa3pPBkNn95huX6V7RnXh49Kj:9IRryXznt87zQcbR1Z9TuX6HX0Kj

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4576	ea5209468b3dc2a9f24010a7c75cc019_JaffaCakes118.exe
4576	ea5209468b3dc2a9f24010a7c75cc019_JaffaCakes118.exe
4576	ea5209468b3dc2a9f24010a7c75cc019_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea5209468b3dc2a9f24010a7c75cc019_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ea5209468b3dc2a9f24010a7c75cc019_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea5209468b3dc2a9f24010a7c75cc019_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsn8D1E.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn8D1E.tmp\TBC.dll

Filesize
94KB

MD5
ec0281fd243bffbfe3cf1558e99b51fc

SHA1
2841c1e42a06d618db54dedc9a5aee48c1c9869a

SHA256
902ce26a56b68e18f4360c7b6a3221757377af06e9125bdaeed8f1290d999659

SHA512
a117af91d786ef824f0b0f978cbc15ebc098f6b57481888d97f0ce503ce39e4a6312cd51ffe32625cbe8c4d019f5b40a4d796608c22eeb95d97150c57080d99c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn8D1E.tmp\nsDialogs.dll

Filesize
156KB

MD5
879ef35b34de9a94762cb32d26ae0db5

SHA1
a9754a70d9456d7b4292a67d44ccf53757ed70ce

SHA256
51480849fec0b57b872a9bf6992f8c98e6ceb79b318b09a48347f6d3e0bc416f

SHA512
9b373b04fdeef8b9f1cbdd7bf412990422497e437ae6fd0bcbe8ae7f8cf343161f4be200b3207960884c09558175157764f9af688c0cac53119db3ceff980ee2

Download Submit
memory/4576-18-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download