6eb1907d73dcc6c599f0c9024d039a591bb1253bdbe8723a4f7b5ca9d7a22c4f

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe
Size

726KB
MD5

109cedbb8947fa100d1d03fcdd59e4a0
SHA1

43521a46c21ec2feadb2db26ab840a6e36f169cf
SHA256

6eb1907d73dcc6c599f0c9024d039a591bb1253bdbe8723a4f7b5ca9d7a22c4f
SHA512

0abcce85981ee0f23cae6b973c244c2cf85230e0f29b564978e96cd40d43966cb1f94490dde02f0c2e16a5e667743c2dd74344adbfd601cd7241b9ca4a6db58e
SSDEEP

12288:ymJthrP63r7UBSgXvesSGoWu7p61Jd5l7w4RhHJZHAzDyb8K6rNh13F5utKoZtTI:ymJ7j7oWm61pl7wSHJNADh13F5DOiQkR

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
3468	109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe
3468	109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe
3468	109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe
3468	109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe
3468	109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe
3468	109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3468	109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe
3468	109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\109cedbb8947fa100d1d03fcdd59e4a0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsvC66F.tmp\InstallOptions.dll

Filesize
15KB

MD5
6e663f1a0de94bc05d64d020da5d6f36

SHA1
c5abb0033776d6ab1f07e5b3568f7d64f90e5b04

SHA256
458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4

SHA512
2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvC66F.tmp\System.dll

Filesize
11KB

MD5
b9f430f71c7144d8ff4ab94be2785aa6

SHA1
c5c1e153caff7ad1d221a9acc8bbb831f05ccb05

SHA256
b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655

SHA512
c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvC66F.tmp\eula.ini

Filesize
2KB

MD5
ca48870c5740cbc515e788abc571f4d3

SHA1
33c47875e3bb2a312ec6dc20fda789675c031533

SHA256
d3ec40ff350180a3d5c5c20e2f1b20e2dd59fa167918a6393405b5cbd9428916

SHA512
d5d109db2f3f7c1fd6f74afa2198231b95160864c3178210b9b9b4bc5e47e5514dac4b79e092c9b339001636f806a06141e99d7b3c5d11ca4d007c3519032a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvC66F.tmp\eula.ini

Filesize
1KB

MD5
dbe003b33841887006f9bea6e6b02930

SHA1
db236eb5595902b5625a4c420f1711764db87242

SHA256
3dd73fd9b98cc07ff99dd6773683929fd60c4f945bb66a66ee18e2aee79c3982

SHA512
b2bc6804dc96a0545874950d25b632da26d506dd9f51b9637475e2c856f478ed4450bf6b9f180d1f321559d7d44e130a155cc843c7dc6de2d164bd98c57e0f5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvC66F.tmp\eula_es.html

Filesize
12KB

MD5
8c7bdcdb17d38d5c4deb299db6a967b4

SHA1
458a35b2ec7642c94857b3487583e1d64ac577f5

SHA256
ddcd59f4d38239e54907979d7b4dac255d4a791f82193be8742aad5b131e0910

SHA512
8d7849126aa6181a7949ba1b7accd7c7bac075d6ac193b8d7edbbaeb2244d35e598e6f070794f5c220de9c25ebcfd4304a5e042cfa5a3072fe0e0d930a663e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvC66F.tmp\installhelper.dll

Filesize
127KB

MD5
91b0372096274dbd47395aa8b28ffedb

SHA1
05d79ba090439c2898d8ad480355c08091acee55

SHA256
0411ab18ecb0d3d6292eabb89b4c8e41112b3e0be272b087555c2cb8cb0bfc28

SHA512
c40b9eace25b6c871eee9b4186181268de7463c4fe1c4c19372413989489fa891ebd528175d15df031dc768613a81c619acce0981a4c29d475e795d18b1aff08

Download Submit
memory/3468-17-0x0000000002C50000-0x0000000002C73000-memory.dmp

Filesize
140KB

Download
memory/3468-163-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/3468-183-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download