ecb743e06ebb7c28773d51407f78f37eace5d0f582573d2084e1cbd4deb000d0

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 08:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

127feba2f13a1f89ed36e2b7530ef727_JaffaCakes118.exe
Size

308KB
MD5

127feba2f13a1f89ed36e2b7530ef727
SHA1

2f08e178bc5ba0b49dc3215c029a0fdd42214518
SHA256

ecb743e06ebb7c28773d51407f78f37eace5d0f582573d2084e1cbd4deb000d0
SHA512

4bc9863d87a382a7fb8bd35e9641c16b9e0c7c9712a10ed4993d567d3ad1c271dc64741bfc71d07329578a628f3c55c54c37e73d0fece2fd91d64fb9c406cedb
SSDEEP

6144:vr+RI5RxWBDg7V0eXze6OvA487E3su7cRO9OUlDrx3G88PkAdgEPZ5yxlkSx:vr+RI3sBDJejgPyM7cROAUlPFG8VER5c

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1924	127feba2f13a1f89ed36e2b7530ef727_JaffaCakes118.exe
1924	127feba2f13a1f89ed36e2b7530ef727_JaffaCakes118.exe
1924	127feba2f13a1f89ed36e2b7530ef727_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	127feba2f13a1f89ed36e2b7530ef727_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	127feba2f13a1f89ed36e2b7530ef727_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\127feba2f13a1f89ed36e2b7530ef727_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\127feba2f13a1f89ed36e2b7530ef727_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Tsu61577609.dll

Filesize
269KB

MD5
73f84010494b1b9e4b478790bbd3d71a

SHA1
136f73ff2ccb0ca4a558f7b72f8d9641bf7ee7f0

SHA256
41a58310d5c51c6dea425a4dd7e79c7dea67be75915512990ac263ff8f6e02a0

SHA512
e57eddfb249597151e09c4aebd9d2d77239ce677cd47d944202ed2a2a68af042c7b0a9725c366414300647d11c3bdafe3f163c065b8b6c89efa56fc764ac2966

Download Submit
\Users\Admin\AppData\Local\Temp\{827FBAC0-596C-4A1D-A8F6-114E599C9836}\Custom.dll

Filesize
58KB

MD5
7cefc6cc05c85c03e380031e7b1aa9a9

SHA1
5d28768ac4bdd826cd94fad129cccf0b772e7be2

SHA256
09af7a06cc8f91d009cf3e23be4409db7ebf1988000f85e57f0bc95719ecf7a5

SHA512
4746c7568306d302b5a9459a380d837cdafdb79d70246b46a987f0d871f9f9bab6fac39482d5554b24b8fe3f4e7267444c4c59331feff3750c4ee372a0931482

Download Submit
\Users\Admin\AppData\Local\Temp\{827FBAC0-596C-4A1D-A8F6-114E599C9836}\_Setup.dll

Filesize
207KB

MD5
9473f38f101e1fdd74761481d4805083

SHA1
5d1bcad363d7c43929c0b8d78b38b52fed737f0a

SHA256
c9e100eb1275a039ef4de4c2a3a6445dfc7ffe7f4a1acc224470137181aeaed2

SHA512
c8b73a09b16bbad167a244ecd613fb4f9fc47972b19d11e3be373253ded77ece636851b34be281bfc81f7e66e7b7a8fb3edcf276fa6d92b9518f043d3a84612e

Download Submit