1dfc6a0b7016b50185c2ca7b71d6b5a40e42bfac7c0051af47e3512213d47481

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef517f2e529dea701c04939456f3ad21_JaffaCakes118.exe
Size

49KB
MD5

ef517f2e529dea701c04939456f3ad21
SHA1

b32b19fbc99ab646903a2cb2bfb97704e6af3b07
SHA256

1dfc6a0b7016b50185c2ca7b71d6b5a40e42bfac7c0051af47e3512213d47481
SHA512

9ba5d51c95096d0491348f7cfbaadf3bc350f31d0ca10ad5565938917eaf50ed2242020040bc8ec7e36c8c6b1f9d1db8a0ebb1a857a59ce86c2d75bc17fd51d4
SSDEEP

768:dMGnYmtcLDs/saQRy7rnzrKHgccoGv8uS08p44vGmjXO3XJC1Mm9B3oHXF045rCE:9oLDYsacy7mHMowHjXJC1MZF0uryihf

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2512	ef517f2e529dea701c04939456f3ad21_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef517f2e529dea701c04939456f3ad21_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ef517f2e529dea701c04939456f3ad21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef517f2e529dea701c04939456f3ad21_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoB972.tmp\nsWeb.dll

Filesize
8KB

MD5
84bcf3c71e70d5a6e9dc07d70466bdc3

SHA1
31603a1afc2d767a3392d363ff61533beaa25359

SHA256
7d4da7469d00e98f863b78caece3f2b753e26d7ce0ca9916c0802c35d7d22bcf

SHA512
61aefa3c22d2f66053f568a4cc3a5fc1cf9deb514213b550e5182edcecd88fadf0cb78e7a593e6d4b7261ed1238e7693f1d38170c84a68baf4943c3b9584d48e

Download Submit