0d43acbb159687bdfda23da84ae785677f0a4c14010be48ead657d2b71a359bd

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-10-2024 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

229da05be0a100309faa895327f9ddad_JaffaCakes118.exe
Size

5.0MB
MD5

229da05be0a100309faa895327f9ddad
SHA1

e288f81cbaea3b1064e8e584ac752e8e0046d881
SHA256

0d43acbb159687bdfda23da84ae785677f0a4c14010be48ead657d2b71a359bd
SHA512

0fb5a0959f9028cc5fd7fff4d516b3057d01b00373a40f481277c8f6b3c495c054abc095c135bc330746123442c8305586a69d343f1ac1e6b4631e7314debcc6
SSDEEP

98304:NkFfHlOwTJ14TxU2DFSpR/TtrnxRDz/b262l2sFTLMicWkavgMNxwVsAIbPMqTe1:N4TJut8pR/BrjDHLpsLMifkaoMQ2desI

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2040	229da05be0a100309faa895327f9ddad_JaffaCakes118.exe
2040	229da05be0a100309faa895327f9ddad_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	229da05be0a100309faa895327f9ddad_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	229da05be0a100309faa895327f9ddad_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\229da05be0a100309faa895327f9ddad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\229da05be0a100309faa895327f9ddad_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy4D28.tmp\ioSpecial.ini

Filesize
637B

MD5
c253eb350c0905f5b05849339311528c

SHA1
db53639ee73550d4c67120384bc31a6fa8b77987

SHA256
7d44760275ca624880979e4e7d1ed9d772fbb0938eced1e95a57d3526276fe18

SHA512
6340147bd0fca0818bb72179a02aa4764100fe8a6ba1c7efce05c84935dce4e24449177421fbad8ab590ad61154322cc15fbb6385c9e18c9fcc56d14f964ae40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4D28.tmp\ioSpecial.ini

Filesize
676B

MD5
23118eebbada7aa41490616a1363ac6b

SHA1
4c336443b95a7f9f50308fc3d860bf5f33da28b7

SHA256
b82e6abf4bdf8f38e09325abbe68777a4a32fceea7671ab8cc543c0a76d6779b

SHA512
576c64200e2ed7d23ad2432cc3862d5c2247550da2f3e6758af3f5669f99740481f75e2f53ec204aed71ca2b65bf25f4766744d1c10f38a48a78e83f353be92f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy4D28.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\nsy4D28.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit