f2b5833e96eee299b284c2340463ece207b1490f4cf75457d041e22d37eed92a

Analysis

max time kernel
144s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

079e8ee8b682f119ee474a96d36d524d_JaffaCakes118.exe
Size

672KB
MD5

079e8ee8b682f119ee474a96d36d524d
SHA1

52549950bcb997bd2a6f13fbb1018b8f65d2375a
SHA256

f2b5833e96eee299b284c2340463ece207b1490f4cf75457d041e22d37eed92a
SHA512

3084286b7606809b75ad9eb5ba3e5623476b6b998d35631112d83f4d777a35320251bb38e5da6421a050bd920d995c462aae8f3a3ccb112a0221647feac554b6
SSDEEP

12288:9s9LnUauV0BIfsgVjU7424qnGgYi5WGJZPP7BHigTsv+BJLfw:6RrIUwj0/7WGJZPzBCgTvBBw

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2808	079e8ee8b682f119ee474a96d36d524d_JaffaCakes118.exe
2808	079e8ee8b682f119ee474a96d36d524d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	079e8ee8b682f119ee474a96d36d524d_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	079e8ee8b682f119ee474a96d36d524d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\079e8ee8b682f119ee474a96d36d524d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\079e8ee8b682f119ee474a96d36d524d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DriverFiles\d42218ebaba1a3818e209e747ef2d08f\winusb.inf

Filesize
4KB

MD5
73f20e2fb290530246762fe233dd9509

SHA1
224efbc41295098b8d1e1b7495500a9912697b93

SHA256
58c903399ab162d1043a6b5fa288fd739302bde7bf8a7c0c8ed28727fe09b3e1

SHA512
cfaab7550c9f8ede1388d76e9a8c18e786db25929759a27510cd47902f664817ae12e1aaae128f3a04a526956ced49f1f36bd015985a2a4d7454fd54acdb49a5

Download Submit
C:\DriverFiles\d42218ebaba1a3818e209e747ef2d08f\winusb.sys

Filesize
103KB

MD5
7c8733775e291e3211f918a30b425742

SHA1
804bb654f45505939c33f7b7419dc3b6e5505ad4

SHA256
ef4dc11990e88b19c8bb565b8e67ce9a146d69a4779d859474ba1effac993280

SHA512
6461448339b36c6085dcb11931f9c69287f6008e9af70bdde6d2cdc16f9d3149b08ba896b6cf65c7360470ff9f8fcabb0250f2a24ef4fdb61ea5264855cc18a8

Download Submit
\Users\Admin\AppData\Local\Temp\fun.dll

Filesize
28KB

MD5
679bf4b879537547244106f1198f8f7f

SHA1
199360a4e163bfe1358ab18c9c11d3b1934129f9

SHA256
81cfe26ee06e165ca7f38cd5eb42ea60990be88305442dca689ce8e0f18891fa

SHA512
754a43c351fbdf05c7813db3d711da657645a6c9ced0dd9ef8efdc28d157efd0503122c75a4ad44fcb7d890f71f700acf99e7c428fb360a76cd384e86433cc80

Download Submit
\Users\Admin\AppData\Local\Temp\zlib1.dll

Filesize
58KB

MD5
80e41408f6d641dc1c0f5353a0cc8125

SHA1
6d957ba632df5b06d49a901f2772df4301610a2a

SHA256
b09537250201236472ccd3caff5c0c12a5fad262e1e951350e9e5ed2a81d9dde

SHA512
857d4dc087c73f00d79bf70edfc67ddc0b15a86a4fff366d91e5ef6684af43eed7dcf8579f6b4fb35dedd090973e2bde1a82aae07642136b608eeb1d567e5c03

Download Submit
memory/2808-24-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-37-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-16-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-19-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-11-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2808-6-0x0000000000270000-0x0000000000283000-memory.dmp

Filesize
76KB

Download
memory/2808-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2808-29-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-32-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-40-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-45-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-50-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-53-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-58-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-61-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2808-66-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download