196d78953b7beeabc50a1c0294312246d52b465fa6d3dacb82fe6be223bce9f4

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea767005d0a9ab6fe2df21c2d0acc8f2_JaffaCakes118.exe
Size

975KB
MD5

ea767005d0a9ab6fe2df21c2d0acc8f2
SHA1

ddbe57dec13343bfed1f36b2ac27f6423247c3c2
SHA256

196d78953b7beeabc50a1c0294312246d52b465fa6d3dacb82fe6be223bce9f4
SHA512

97d8950bc0cc06529d57a693ff60de19e7a5ee4c60a0430a9171aec53fdf448ac210ff5f3f49a15b059d76ba16e3f14a469dde38ae1691450ebb121890879720
SSDEEP

24576:zw2RXQaFWw2HR9ySnx2yE3G04IY1xTuMbcR6Tcvbqq54L:zwoaNnx2v3G04IY1xTuiTob/4L

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2100	ea767005d0a9ab6fe2df21c2d0acc8f2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea767005d0a9ab6fe2df21c2d0acc8f2_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2100	ea767005d0a9ab6fe2df21c2d0acc8f2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ea767005d0a9ab6fe2df21c2d0acc8f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea767005d0a9ab6fe2df21c2d0acc8f2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsoAC57.tmp\ioSpecial.ini

Filesize
739B

MD5
1ff049791b9616a3237d76bfff5e75d3

SHA1
57f06a4756328747db7692dd6adeaae9c5a0255e

SHA256
461432ce7a3d2624493e76a0f4924a4fda61dec76a34b6b2ba3e3f53369c7ed7

SHA512
f0c55c405bf0a9622e06e416c9874074c1993764be6d486ff3ee60518737d165e72a4d33f793a8e297e0188368fba3d7544e84af08955d6e424888fecbdf3d51

Download Submit
\Users\Admin\AppData\Local\Temp\nsoAC57.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit