6278156553ce26bbc3823de753ee82594701be867ede9b97d852adef98652b46

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
Size

2.2MB
MD5

164aae0ae02ea76e8547a5b4b1701e5c
SHA1

fc14db72681c9b701386ff442b70648b79f17a32
SHA256

6278156553ce26bbc3823de753ee82594701be867ede9b97d852adef98652b46
SHA512

b3d0038d79b1b3f90c55c70531c2cac3d4489e79e1d4da7cc08ce0a06e5ba14cddf038a5b7b632426779a5907a95ce9ea1ac8c20d513143e938b2d78c72ccd56
SSDEEP

49152:AEaVFO540EC/uHKveO1OKX6WxulUA4Ugzuep0CwZhey+eEhu5HGkEMWEClyEzu:AEaVy4C//eO196z4Uaue5wZhereCj1j+

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
5012	164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\164aae0ae02ea76e8547a5b4b1701e5c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsf79E4.tmp\DLLWaitForKillProgram.dll

Filesize
28KB

MD5
9c4b8ec42d89f7557bfd90798ce52787

SHA1
2376dde426ea65aa27c30e304086310605382475

SHA256
ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548

SHA512
17c12a27a08746755868558c037376dd7e20f03f0f71888c1329903b70975a54f57786c3c32bf88aaf30119f11ed978a6830ba91949e11cfc94fbb5ad95305b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf79E4.tmp\FILEDownPlug.dll

Filesize
20KB

MD5
b118053825642ecf3bba36500a70645b

SHA1
ce436f731bd8bf744399bf39e77f7bca5a4461af

SHA256
eb97c0e8d17986beb01c1366405c8fa70e5d69c5f82b30f184454a47c258fda5

SHA512
11e00d2e2fc6b85e96de5b9fd11ea3f1d681180879ac3c2a7cfbe35a3808466f8eaff70faa39d6f5739238a34558825a22f0887d5653df54305a3ccce3836c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf79E4.tmp\InstallOptions.dll

Filesize
14KB

MD5
eef9e469e8a30717974499f277d97e2a

SHA1
2d33c25984ebd9116beeb55cdde4c5c86c023e5d

SHA256
1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

SHA512
d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf79E4.tmp\KillProcDLL.dll

Filesize
36KB

MD5
6958016193a066833556992077bad4fe

SHA1
5f564945936f99381d7e2408f034f97d069005a4

SHA256
f38c669c87f2a73768a27a01622690997e9d93d5ca3830b349bd24c3ff9f8d2e

SHA512
fd6ab5c341b331b80c940ba97a2cd14547c796933a2df26d3dd87ede1602b86d9f8c37baebd7dd4c68d811199fc96a27ad4cb995bb8889d51af91db9f43ba0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf79E4.tmp\ioSpecial.ini

Filesize
599B

MD5
0484b2e77675b003701a598ba9c076b0

SHA1
de14a2788ec965ffc546a92b7bd1eee707cfc8b7

SHA256
dce8eddef3aa122d797fc360b749975aac1b051d799a6dc362941e3af6958fb2

SHA512
2ef9099b4fc672c7cb875b1453ef975a4259772bbedc014d5ad72cb114174046e7087195d5c91301cff302c4c6c83659d8517a3e3f2122e1df0682197d19beb2

Download Submit