853a22fbcdcdff08189f96dcf352d80e7fc7ebcb0b80db7ea5ef92bd7fb22349

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac5755ac9ce32484212bb80979a6356_JaffaCakes118.exe
Size

2.0MB
MD5

eac5755ac9ce32484212bb80979a6356
SHA1

6db81f38ae1e6c8099a4723c8b961bc495c9a48a
SHA256

853a22fbcdcdff08189f96dcf352d80e7fc7ebcb0b80db7ea5ef92bd7fb22349
SHA512

d28fda4b33ce3218ff075f8260344b93da8d5839e9881bdc1d0c618bc972d24ed476d8a2abfc787c573877b474468f37a8c509b817b00e16c7e13eaad9584166
SSDEEP

49152:A0W1r+cYeiVsBZfdPq7HfV2C3GFZRAYEyXQ1:TWVaei8TPq7HfV2DLRBC

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2056	eac5755ac9ce32484212bb80979a6356_JaffaCakes118.exe
2056	eac5755ac9ce32484212bb80979a6356_JaffaCakes118.exe
2056	eac5755ac9ce32484212bb80979a6356_JaffaCakes118.exe
2056	eac5755ac9ce32484212bb80979a6356_JaffaCakes118.exe
2056	eac5755ac9ce32484212bb80979a6356_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eac5755ac9ce32484212bb80979a6356_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	eac5755ac9ce32484212bb80979a6356_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eac5755ac9ce32484212bb80979a6356_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eac5755ac9ce32484212bb80979a6356_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdC785.tmp\AdvSplash.dll

Filesize
5KB

MD5
41be2441ee7c684eaa76a62d4223b4c7

SHA1
05de8220e296db1025f7bd4d9de1f44370018162

SHA256
0990902460ec38bcd605b518bffa081942c6f4c5fe1828a61ba3965bbf15d8bd

SHA512
fec074a2196141e497334b57563dc7863a0b949d348164aec8c4f21d1b3c4ed795e03fd6e5726a2e90da7015abfbb4e28102647c0e343e84a707e99271a1a938

Download Submit
\Users\Admin\AppData\Local\Temp\nsdC785.tmp\System.dll

Filesize
11KB

MD5
959ea64598b9a3e494c00e8fa793be7e

SHA1
40f284a3b92c2f04b1038def79579d4b3d066ee0

SHA256
03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

SHA512
5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

Download Submit
\Users\Admin\AppData\Local\Temp\nsdC785.tmp\UserInfo.dll

Filesize
4KB

MD5
d16e06c5de8fb8213a0464568ed9852f

SHA1
d063690dc0d2c824f714acb5c4bcede3aa193f03

SHA256
728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531

SHA512
60502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a

Download Submit
\Users\Admin\AppData\Local\Temp\nsdC785.tmp\nsDialogs.dll

Filesize
9KB

MD5
f7b92b78f1a00a872c8a38f40afa7d65

SHA1
872522498f69ad49270190c74cf3af28862057f2

SHA256
2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e

SHA512
3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79

Download Submit