ac34294ef70daf86776ecf5e41bb4ed159c5988e07fea600d47663b8ca965ea9

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
Size

501KB
MD5

461d493f3cd94fb46c30aa9cd9652051
SHA1

63013a67ff2e677cfe90d9e2a47b9403975fa74e
SHA256

ac34294ef70daf86776ecf5e41bb4ed159c5988e07fea600d47663b8ca965ea9
SHA512

9e013091e854d47b289577add4ee36c51810937010a95d50798779a348778907d6bf3e8d2b21f7ac2b83de6bedd1af46fe5645a99b0a486e9f18ea944fe949f4
SSDEEP

12288:73va5XhbwIEzYYywP7RYvXog1L0nockSHQMC6mn+oClj:7GwIEUYyAYggZ0odSHphm+Plj

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
456	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\nMailDirect2.3.exe	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File created	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\nMDHelp.chm	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\nMDHelp.chm	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File created	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\Uninstall.exe	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\Uninstall.exe	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File created	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\install.log	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
File created	C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\nMailDirect2.3.exe	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\461d493f3cd94fb46c30aa9cd9652051_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PAVERASOFT\nMailDirect 2.3Demo\nMailDirect2.3.exe

Filesize
860KB

MD5
c488cce04c71bc34429840f9829a9442

SHA1
5c6a66764aa4db648efc8f011b165702558303e3

SHA256
64abc38526f3c6fd5e85fd5d2618dbe99f19e671132394d88f02faf103062d7f

SHA512
ae7239924a44e6904ace0156a01c4603ad2d9fb82f391a016d6edfee2c346e09107c3ed69d3e15b0cc19e66d91c5c6c58f8e45c95dca6e41fe6f7412a42ccfe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\xns859B.tmp

Filesize
666KB

MD5
9e4c97a1229d3c4f3d159efbc622167d

SHA1
00425cb79da640e33567b7367209a551c4b0cf83

SHA256
615643ee0cf61ba2d2e9fdf7469ef82b4f8c5a6805e7efb3b9c9dcc167c55b52

SHA512
8cd9b80c803e2290d25d979b9e48b873e8e10e9a09e91375234e71adcf217722059adf2970a1974678267546947cf7ba0c185532571d931bc3ecfbf5de948c3e

Download Submit