6278156553ce26bbc3823de753ee82594701be867ede9b97d852adef98652b46

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
Size

2.2MB
MD5

164aae0ae02ea76e8547a5b4b1701e5c
SHA1

fc14db72681c9b701386ff442b70648b79f17a32
SHA256

6278156553ce26bbc3823de753ee82594701be867ede9b97d852adef98652b46
SHA512

b3d0038d79b1b3f90c55c70531c2cac3d4489e79e1d4da7cc08ce0a06e5ba14cddf038a5b7b632426779a5907a95ce9ea1ac8c20d513143e938b2d78c72ccd56
SSDEEP

49152:AEaVFO540EC/uHKveO1OKX6WxulUA4Ugzuep0CwZhey+eEhu5HGkEMWEClyEzu:AEaVy4C//eO196z4Uaue5wZhereCj1j+

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd99D0.tmp\ioSpecial.ini

Filesize
599B

MD5
ef0b680788c057705e8e6dcc2f838138

SHA1
cdc59e5145055b56168e9788d8d20958af7fb820

SHA256
200a8adc14cc97276b42324e5d3d82b66ca7ced3fff59b4cd8a4d7801bc89fc0

SHA512
169baf5630cb1db8997c2c4563a88aac488508532ec0079094cb6df2bfe48ecd7458e5c2a2da89f6af8714d9719cac8e78f6f9cfe0fc6e06684340303318e8e5

Download Submit
\Users\Admin\AppData\Local\Temp\nsd99D0.tmp\DLLWaitForKillProgram.dll

Filesize
28KB

MD5
9c4b8ec42d89f7557bfd90798ce52787

SHA1
2376dde426ea65aa27c30e304086310605382475

SHA256
ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548

SHA512
17c12a27a08746755868558c037376dd7e20f03f0f71888c1329903b70975a54f57786c3c32bf88aaf30119f11ed978a6830ba91949e11cfc94fbb5ad95305b7

Download Submit
\Users\Admin\AppData\Local\Temp\nsd99D0.tmp\FILEDownPlug.dll

Filesize
20KB

MD5
b118053825642ecf3bba36500a70645b

SHA1
ce436f731bd8bf744399bf39e77f7bca5a4461af

SHA256
eb97c0e8d17986beb01c1366405c8fa70e5d69c5f82b30f184454a47c258fda5

SHA512
11e00d2e2fc6b85e96de5b9fd11ea3f1d681180879ac3c2a7cfbe35a3808466f8eaff70faa39d6f5739238a34558825a22f0887d5653df54305a3ccce3836c73

Download Submit
\Users\Admin\AppData\Local\Temp\nsd99D0.tmp\InstallOptions.dll

Filesize
14KB

MD5
eef9e469e8a30717974499f277d97e2a

SHA1
2d33c25984ebd9116beeb55cdde4c5c86c023e5d

SHA256
1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

SHA512
d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

Download Submit
\Users\Admin\AppData\Local\Temp\nsd99D0.tmp\KillProcDLL.dll

Filesize
36KB

MD5
6958016193a066833556992077bad4fe

SHA1
5f564945936f99381d7e2408f034f97d069005a4

SHA256
f38c669c87f2a73768a27a01622690997e9d93d5ca3830b349bd24c3ff9f8d2e

SHA512
fd6ab5c341b331b80c940ba97a2cd14547c796933a2df26d3dd87ede1602b86d9f8c37baebd7dd4c68d811199fc96a27ad4cb995bb8889d51af91db9f43ba0a7

Download Submit