7aecca1e688614033811578d7980a61d9339c43579e4425eea1eaca2bafc1396

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

538c7c0f65b03c147b884063747c3deb_JaffaCakes118.exe
Size

438KB
MD5

538c7c0f65b03c147b884063747c3deb
SHA1

ff13624567bd3eeb2fa7901faca9cc46c70b656b
SHA256

7aecca1e688614033811578d7980a61d9339c43579e4425eea1eaca2bafc1396
SHA512

26c6ff63e21cb0c936e29246f1aad015620bfa8e037a19703b90038a397574ebe2e57d7fcb3cc8ea1f7ea2cd24495264abc093f18e050668f90c36c883a47d64
SSDEEP

12288:O5DAjOKJxK/ZXQEyefJO+jVwGOYJbEuItr63iNrr:OlKJxK/YmfGGnRENVNX

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2640	538c7c0f65b03c147b884063747c3deb_JaffaCakes118.exe
2640	538c7c0f65b03c147b884063747c3deb_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	538c7c0f65b03c147b884063747c3deb_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	538c7c0f65b03c147b884063747c3deb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\538c7c0f65b03c147b884063747c3deb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\538c7c0f65b03c147b884063747c3deb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GLC4663.tmp

Filesize
161KB

MD5
09e59d00df5d2effd8dd9b30385cb9d2

SHA1
0fa0d3f6692f31fdabefb719b0f7a28cbf5d5415

SHA256
1c574eab5e83ccfe5a0bb7b59e028cc5fa2f4e77868051e305d83c709711ff77

SHA512
d73e3832777341a4176dbd9988002ec94a32f162492e869a8c03d9bb10f1833821f99e15710e9fc103a2820c862cf14a0b990d7c7c09150bb14618a7c93ca5fd

Download Submit
\Users\Admin\AppData\Local\Temp\GLK4673.tmp

Filesize
33KB

MD5
517419cae37f6c78c80f9b7d0fbb8661

SHA1
a9e419f3d9ef589522556e0920c84fe37a548873

SHA256
bfe7e013cfb85e78b994d3ad34eca08286494a835cb85f1d7bced3df6fe93a11

SHA512
5046565443cf463b6fa4d2d5868879efc6a9db969bf05e3c80725b99bd091ce062cfe66c5551eb1cc5f00a38f2cfcda1f36fb4d60d9ff816c4ec3107b5a0df40

Download Submit