ac34294ef70daf86776ecf5e41bb4ed159c5988e07fea600d47663b8ca965ea9

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
Size

501KB
MD5

461d493f3cd94fb46c30aa9cd9652051
SHA1

63013a67ff2e677cfe90d9e2a47b9403975fa74e
SHA256

ac34294ef70daf86776ecf5e41bb4ed159c5988e07fea600d47663b8ca965ea9
SHA512

9e013091e854d47b289577add4ee36c51810937010a95d50798779a348778907d6bf3e8d2b21f7ac2b83de6bedd1af46fe5645a99b0a486e9f18ea944fe949f4
SSDEEP

12288:73va5XhbwIEzYYywP7RYvXog1L0nockSHQMC6mn+oClj:7GwIEUYyAYggZ0odSHphm+Plj

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2536	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
2536	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
2536	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
2536	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\nMailDirect2.3.exe	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\nMailDirect2.3.exe	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File created	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\nMDHelp.chm	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\nMDHelp.chm	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File created	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\Uninstall.exe	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\Uninstall.exe	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File created	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\install.log	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\Uninstall.exe

Filesize
346KB

MD5
4c3a4c100f67758378010fbcc60e2613

SHA1
f9fe57ccc9ddb2f3ff41a441a28fed6b19b30769

SHA256
ba217701ff99d75b72b26389ced34422b8be15c97603f82a21c1a5dc86252d9a

SHA512
3c66723b189e75d597494d040b3a5a306dbb06be8511128573f4089cbc370c6c31eba593564ae57e521d735f055796d5081484d722fdcd8d7f2aba0ad60d26ce

Download Submit
\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\nMailDirect2.3.exe

Filesize
860KB

MD5
c488cce04c71bc34429840f9829a9442

SHA1
5c6a66764aa4db648efc8f011b165702558303e3

SHA256
64abc38526f3c6fd5e85fd5d2618dbe99f19e671132394d88f02faf103062d7f

SHA512
ae7239924a44e6904ace0156a01c4603ad2d9fb82f391a016d6edfee2c346e09107c3ed69d3e15b0cc19e66d91c5c6c58f8e45c95dca6e41fe6f7412a42ccfe2

Download Submit
\Users\Admin\AppData\Local\Temp\xnsB339.tmp

Filesize
666KB

MD5
9e4c97a1229d3c4f3d159efbc622167d

SHA1
00425cb79da640e33567b7367209a551c4b0cf83

SHA256
615643ee0cf61ba2d2e9fdf7469ef82b4f8c5a6805e7efb3b9c9dcc167c55b52

SHA512
8cd9b80c803e2290d25d979b9e48b873e8e10e9a09e91375234e71adcf217722059adf2970a1974678267546947cf7ba0c185532571d931bc3ecfbf5de948c3e

Download Submit