a62754f98f2f25c01db50fdc74dd89a312cdc50d7aa607acb1e80b858294e152

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f317760b6d2220450d348a8941dd26c_JaffaCakes118.exe
Size

1.4MB
MD5

3f317760b6d2220450d348a8941dd26c
SHA1

63c2402391077b197963d5d60c9c23a94331b07c
SHA256

a62754f98f2f25c01db50fdc74dd89a312cdc50d7aa607acb1e80b858294e152
SHA512

6c39f88fce263be6e3f996e365ba913e265a296e75d0d8dd382a0af0f28b2757a76d0ec100910000f4900ddd0cdcb7fbdaed5a561f10b6192ae79412ef0753c7
SSDEEP

24576:B+0Dp2TOCfb4DhieR1JhM0eieDQNCABIISEHZspBjnY7BF1O3RkjXNuEJ3h:B+0DpcnIhpxlde0NCkSmZsEtFskxuEJx

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
628	3f317760b6d2220450d348a8941dd26c_JaffaCakes118.exe
628	3f317760b6d2220450d348a8941dd26c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f317760b6d2220450d348a8941dd26c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3f317760b6d2220450d348a8941dd26c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f317760b6d2220450d348a8941dd26c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsx9924.tmp\InstallOptions.dll

Filesize
12KB

MD5
1d5c649dde35003a618b9679d5d71b92

SHA1
0409bbab3ab34f8c01289cdd847b4d1a32d05b18

SHA256
0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

SHA512
b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx9924.tmp\System.dll

Filesize
10KB

MD5
4eff5fafd746f5decb93a44e3a3d570c

SHA1
a11aa7681b7e2df1c7f7492a127d332d1495ea8a

SHA256
cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

SHA512
cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx9924.tmp\ioSpecial.ini

Filesize
740B

MD5
2c36714bb5a2a251bf70b09fa47db56b

SHA1
6d2a119fcfb56b27e14bf5f05da51251c6fe242d

SHA256
1fcbf3d1d7688a6ecf509af31c47210004abf64581d9ab173a0e339337208f33

SHA512
8928594a4ab535e443b47361e5591eaa7a84410ce543fdd6685a9b1c7ff4b99fb549f3054f4b090b1f3063c644e7e176d9fd1b778d09994655ef1599047c95b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx9924.tmp\ioSpecial.ini

Filesize
740B

MD5
b1484c3c692cee45dd66b38a4c9321de

SHA1
072c20fcce832a1f4fae255f146b0486f0e74b21

SHA256
a41b2da268aa8d89f65eaa1e0be42955f75c97b36bec5b1913cd759839f7a7ac

SHA512
e16351e360481aacd80df2f29a1ba1c7946f9e3fdd66059eb5f8dbf824568599af0ab76f056eeb7339b0a10258ac7b30036536aab9661d6f0f53e0c9a5aab7bf

Download Submit