9b3992193d3661c3605576230693556cb76e202be8d084e5a0548b328ee7afef

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a204aea28908b5230ae51c6fbff9ec0_JaffaCakes118.exe
Size

23.2MB
MD5

1a204aea28908b5230ae51c6fbff9ec0
SHA1

71db4e02f6ada852a1a71ef12e48b68dde1e9059
SHA256

9b3992193d3661c3605576230693556cb76e202be8d084e5a0548b328ee7afef
SHA512

485dbdf95e82b20b7d17cc0f04fd9525afe96a5690284f5daf36e68f362643897da5d43549f9d2f7f6324d4072760df3e6a03afa3920036dc4ac26d2178d2195
SSDEEP

393216:QwYa5spFeIwDDyMTtOe7cdaYnfeOD4AmJONvTo3ofrzRUt3f9SNu8q84:QW5fIwjtOnwCeOoi8YTzRfNxT4

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2696	1a204aea28908b5230ae51c6fbff9ec0_JaffaCakes118.exe
2696	1a204aea28908b5230ae51c6fbff9ec0_JaffaCakes118.exe
2696	1a204aea28908b5230ae51c6fbff9ec0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a204aea28908b5230ae51c6fbff9ec0_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	1a204aea28908b5230ae51c6fbff9ec0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1a204aea28908b5230ae51c6fbff9ec0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a204aea28908b5230ae51c6fbff9ec0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst1C6.tmp\ioSpecial.ini

Filesize
830B

MD5
a9ebf7eb5c421d4b88735f66c6648b33

SHA1
82fd1bad0c5d89c7f6f68cf818d679ee6573ce94

SHA256
2558c527c535fdd17692d04f86c50e75be033a2e8af78fa2029a8dff270bac51

SHA512
cdb27f1aa46368003f0d84b60357f7f84eb96ab152c942dd48ff73d766b818cc319b7002ea506278f7fe4969bdc46e132be5359e11318877013fec462f9f9946

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst1C6.tmp\ioSpecial.ini

Filesize
882B

MD5
13b61834b1ec73be1561ea4b3d8e3b37

SHA1
15e8f1d8ab29f3f811a46357e0e745c5a420a32f

SHA256
e25b23861b17d190b245a796c5ee052c49e88a77be3dbc77f8393ebf5042b30d

SHA512
cded5cff7b118a6defb0788086ef650ce77ce3a9978dc61ce50cc2d5dfb5c4d5962a58eeafcede4dba82533e243ceb93982a022f95dd6156ac9b705ab35e56c9

Download Submit
\Users\Admin\AppData\Local\Temp\nst1C6.tmp\InstallOptions.dll

Filesize
14KB

MD5
20f3184efe7edddfef3325efc25d12a5

SHA1
8db4c500d73f9525a7e9834df6caea2e70189939

SHA256
0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a

SHA512
433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a

Download Submit
\Users\Admin\AppData\Local\Temp\nst1C6.tmp\LangDLL.dll

Filesize
5KB

MD5
ea60c7bd5edd6048601729bd31362c16

SHA1
6e6919d969eb61a141595014395b6c3f44139073

SHA256
4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

SHA512
f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

Download Submit
\Users\Admin\AppData\Local\Temp\nst1C6.tmp\advsplash.dll

Filesize
5KB

MD5
669030d7919ae29999a2fd89aa427202

SHA1
870bcb7e87bbf423abcbc1c5be80f7e63720a6d8

SHA256
e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82

SHA512
1637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f

Download Submit