761e9816e1ee0adf78b0322bbb44cd6a3ab162db1bcc1a969d6bbbb9e1e9896f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16e5e3b6ccf6ac7eac59c0acde4081bf_JaffaCakes118.exe
Size

307KB
MD5

16e5e3b6ccf6ac7eac59c0acde4081bf
SHA1

8863c64b7de36c9668d860c5e4f5396701bf93db
SHA256

761e9816e1ee0adf78b0322bbb44cd6a3ab162db1bcc1a969d6bbbb9e1e9896f
SHA512

d22f5b468f7d24e1556d63f3c380251733c6b373d3fae716ec7b069a5418d009f0b53ecd7235cda4be13dc4f95c204e9e93862159b9faf5de2f35582856eab32
SSDEEP

6144:vaHMRI/8jwAofnnFkteNdzmsxeFaaL+TtulZpcc:ysa/8ifFk47zmsxOae/lZpcc

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1232	16e5e3b6ccf6ac7eac59c0acde4081bf_JaffaCakes118.exe
1232	16e5e3b6ccf6ac7eac59c0acde4081bf_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16e5e3b6ccf6ac7eac59c0acde4081bf_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\16e5e3b6ccf6ac7eac59c0acde4081bf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16e5e3b6ccf6ac7eac59c0acde4081bf_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\brickworks.dll

Filesize
188KB

MD5
917874763a917e3ec25a38c5f73d8abd

SHA1
f08b1c7b7bb6e65a5a76cb369f21f3ae2c631e47

SHA256
49e447af86d7f28d9d30d194de186d57efa5dc58e93c74bb27d0acc8a04bdf68

SHA512
a39f0f80f5ebdc6bf40f497c93248ae9815755fb59ba67534b2e18b216a3ddb8b9775c25419350cb42722d6a20131aa178be1d939c5535e40fb603c5b5c39a9f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyB878.tmp\System.dll

Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit