a99c0f9c268012b373a2b194951b66154f475f991e522ea18cff550b271919f1

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

385f1ae170d67a18ad23e9d312b9e6f7_JaffaCakes118.exe
Size

107KB
MD5

385f1ae170d67a18ad23e9d312b9e6f7
SHA1

dabbe01ab75a100d402e80ee4ede039b5d4af950
SHA256

a99c0f9c268012b373a2b194951b66154f475f991e522ea18cff550b271919f1
SHA512

8f773ff63dd6c7d7f3dea992898e6d1b7d944d37c3c451d0c2d0c75c7995f6a86bf1cee5fede9ce783b73ce835f7a485f6ba50eff0f781404465c24238c7d532
SSDEEP

3072:I80IwJxDieMR2F6hDmxLhbvpu7fYVuP4Anlw9:IVYR28hmdhbvp5sP4AS9

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
744	385f1ae170d67a18ad23e9d312b9e6f7_JaffaCakes118.exe
744	385f1ae170d67a18ad23e9d312b9e6f7_JaffaCakes118.exe
744	385f1ae170d67a18ad23e9d312b9e6f7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	385f1ae170d67a18ad23e9d312b9e6f7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\385f1ae170d67a18ad23e9d312b9e6f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\385f1ae170d67a18ad23e9d312b9e6f7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gentee00\gentee.dll

Filesize
96KB

MD5
427d8406efd63d3ed906c565c73fd610

SHA1
58b4d079e9e672cdf3bd234a15ee23d0f6393b86

SHA256
916a58e9bd8327792e4fdb83d4439536ce88ddc3a6cdc69cae579af7088078dd

SHA512
9ba70be20367295c9187e8419d7e0e6444f821292d4e021611c1f13ff91e78f86fce285f50d793a34c34569fee225362e5232737797836d89e15aabd17f03cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\gentee00\guig.dll

Filesize
20KB

MD5
fa3db33dcefded7b4fdcb948a5e6e53e

SHA1
0adfd644e4422ffcbcfd8bfc27fcec727f04836e

SHA256
424025e13c1a624d5900f7b264145907e1092ef68e9c51d76a2648d14fdb9a17

SHA512
9be40412d7a8939a41c764058b138f1aa6fa73e0f1d2aa8c251c4e58c0cedbcf9aeee1bf669fc4347e1bccc7a9310f25ebe4731530cc5d99c64e31ef6073623a

Download Submit