fa0572c044c10429d2a7e84b03d315dc414ffa06fdcf81e39ecd2e8583fbddd5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe
Size

2.8MB
MD5

ee9149569ff6bd167a0a9eaedb0ad77d
SHA1

226fa6859c0cc112f66b43907ba9be87573ef67e
SHA256

fa0572c044c10429d2a7e84b03d315dc414ffa06fdcf81e39ecd2e8583fbddd5
SHA512

ed030764479d1a2f94e0ebab1701df796f615ed5975678fedf99da29bea2b8fa170682fcd03006db3b47c36dd17dbdf7b49b657f7f94ea13ef1a482b8d0cab76
SSDEEP

49152:4eP6VXAMh3sjVY8skSsAQGRTYWltYTzuFgV9gnEwMjAu5AJrOry3gIsppt:DihAe3sZDZglCTzuFOgEw2AoA9OGzspD

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2412	ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe
2412	ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe
2412	ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe
2412	ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe
2412	ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe
2412	ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2412	ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee9149569ff6bd167a0a9eaedb0ad77d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdD5D7.tmp\ioSpecial.ini

Filesize
611B

MD5
efe2cd49b42eb3c566f8e8d6414b5f0e

SHA1
8379953cfee052fa1ae8f288d3a2aace01bf7d03

SHA256
d8fe36ebf8f074b2a527342dcd745b821fb49526062a6921e8c094696e51bdef

SHA512
578cf8df4a847ad6e60b55e2335113cb1e2f73be75b7058922d41d527243cdf62df79782143bb9cfb58bf5d614093cf0ff81a4c34a642d906a7eecea6c4a296c

Download Submit
\Users\Admin\AppData\Local\Temp\nsdD5D7.tmp\ButtonLinker.dll

Filesize
7KB

MD5
dd85ac7d85c92dd0e3cc17dfd4890f54

SHA1
a128fb7a05965c1a9913c6f5e419e6c4c0a7d2fa

SHA256
27abd2a4fb1bf66add60221b52d061bbe24d2d21e13600725ff7a5c6c777b504

SHA512
e4ff8216c65110a9d156f37c2062acb53a72daa8af12dfc24278920d9e1a4083a81b1446759df75405b2da34c7bfb1afc33184feedd0aee4ed73f79fcbb1a8a1

Download Submit
\Users\Admin\AppData\Local\Temp\nsdD5D7.tmp\FindProcDLL.dll

Filesize
3KB

MD5
8614c450637267afacad1645e23ba24a

SHA1
e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

SHA256
0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

SHA512
af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

Download Submit
\Users\Admin\AppData\Local\Temp\nsdD5D7.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\nsdD5D7.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsdD5D7.tmp\waterctrl.dll

Filesize
16KB

MD5
3d2a9eebe3b8d170cd5ddc4baecb4386

SHA1
4106951885c5d2168c74a192c2818228c2a67462

SHA256
491e350cdc0320a6a9cbc1470a5490fe29eec67624da63ea9301d1dc8199b6a1

SHA512
819c8a85941eb4b6ab998c0b768a8484c6aad536431dc9d426971c96f2d17e3decee7bd1d5be511cb830f4f2277728b84411d624221b4246d91959ea5d07a649

Download Submit
memory/2412-12-0x0000000000870000-0x0000000000873000-memory.dmp

Filesize
12KB

Download
memory/2412-206-0x0000000000870000-0x0000000000873000-memory.dmp

Filesize
12KB

Download