f60e02db7d4e8402ac248753baa56408c64ed20bbc5d1b626f66a8b48ac4f0a5

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
Size

418KB
MD5

0c1b9cbf10f23a239fec1a89f0170222
SHA1

c89b13b04c2770fa85e2ea9658e8492e4ca87891
SHA256

f60e02db7d4e8402ac248753baa56408c64ed20bbc5d1b626f66a8b48ac4f0a5
SHA512

6dd11ba539eb21f9b91c0a7aa111c46588e9750d6c7ea3800816d63fe13b0c3d335999bbc55489518d2e33c616080ef85712f76af96c2f13013f68ec5d46b3ba
SSDEEP

12288:Qutrzh9xOXkF2G+UCajOIAOswrIz7DLW/wY60c:Qutr5OUFhB9Me0HDMV3c

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\browser	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File created	C:\Program Files\browser\IA2Marshal.dll	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File created	C:\Program Files\config.ini	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File opened for modification	C:\Program Files\config.ini	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File created	C:\Program Files\browser\application.ini	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File opened for modification	C:\Program Files\browser\application.ini	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File opened for modification	C:\Program Files\browser\platform.ini	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File created	C:\Program Files\browser\AccessibleMarshal.dll	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File opened for modification	C:\Program Files\browser\AccessibleMarshal.dll	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File created	C:\Program Files\browser\js3250.dll	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File created	C:\Program Files\__tmp_rar_sfx_access_check_259450223	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File created	C:\Program Files\browser\platform.ini	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File created	C:\Program Files\browser\firefox.exe	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File opened for modification	C:\Program Files\browser\freebl3.dll	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File opened for modification	C:\Program Files\browser\firefox.exe	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File created	C:\Program Files\browser\freebl3.dll	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
File opened for modification	C:\Program Files\browser\IA2Marshal.dll	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
948	0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c1b9cbf10f23a239fec1a89f0170222_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads