7a8d168bb1256401fdac6fa662956a1e7c01e2f399bba8b193081e588869af9c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d0047fff2f917e95a568f57a323aaa8_JaffaCakes118.exe
Size

629KB
MD5

3d0047fff2f917e95a568f57a323aaa8
SHA1

277f974f11474f90aef0b443c4fdb892932f30a8
SHA256

7a8d168bb1256401fdac6fa662956a1e7c01e2f399bba8b193081e588869af9c
SHA512

62054913fa92529c66a90f2bbccc44214d9812da05ba531a6ecdfea739ed724b500ddadbae04433f785571eb9adf2a478c8acf1a5c1518025ef0976368db438a
SSDEEP

12288:uoEH4yZgUGuHIn0YPq0WvSTWs8wt5ETXlFo0/JgBlMDZWseMaF8ZRC:uo04yZg4ILq0v8wt5ETVq0/+M89MDZ4

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2684	3d0047fff2f917e95a568f57a323aaa8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d0047fff2f917e95a568f57a323aaa8_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	3d0047fff2f917e95a568f57a323aaa8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3d0047fff2f917e95a568f57a323aaa8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d0047fff2f917e95a568f57a323aaa8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsjBF6B.tmp\ioSpecial.ini

Filesize
647B

MD5
2eb05fad71862f8d1dcac574db842bce

SHA1
0df0a74c6daafb5d8582090a1df735e11e4288a8

SHA256
cd1efa6b1d6825073802d1e925a3657d127090db7a04a7d12f7b21956b51c570

SHA512
53d9dbb2d2a61894f57808277e65807a735b6015aac5052ce4990c937669cdcb40515435e8c88d150b139d13cede55961a6955b3a8199cb5e6c17d492e39ccfe

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBF6B.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit