Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12-12-2024 04:43

General

  • Target

    e4be75c471d13df766c869ef78e63698_JaffaCakes118.exe

  • Size

    331KB

  • MD5

    e4be75c471d13df766c869ef78e63698

  • SHA1

    96510afbe52c4897b53bf6c9a0a71bd6c4961949

  • SHA256

    9eef2d09ceecb2014ef5fff7ff2fcacbfb7106bcd18bbc1b717d36e898e469d8

  • SHA512

    8280d408e26f282e8686c3199c4b3bb99482abf06e04dc646700e69a2fc3d50f4aeb9dbe7f20239a078eec7749fc920ab12d2b85da50950a97e4405bb2a24491

  • SSDEEP

    3072:lmnOYAZEKVkMRvGzdJW+uB9t+0q1765b20AyrhKD1RHT1I9A2rD0vkjyiOykNScS:lmORZEvm+uPsT76v2D2/rDV2Sc6VRn

Malware Config

Extracted

Family

gcleaner

C2

gcl-page.biz

194.145.227.161

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

  • Onlylogger family
  • OnlyLogger payload 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4be75c471d13df766c869ef78e63698_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e4be75c471d13df766c869ef78e63698_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1540-1-0x0000000002C30000-0x0000000002D30000-memory.dmp

    Filesize

    1024KB

  • memory/1540-2-0x00000000002C0000-0x00000000002EF000-memory.dmp

    Filesize

    188KB

  • memory/1540-3-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1540-4-0x0000000002C30000-0x0000000002D30000-memory.dmp

    Filesize

    1024KB

  • memory/1540-5-0x00000000002C0000-0x00000000002EF000-memory.dmp

    Filesize

    188KB

  • memory/1540-7-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1540-6-0x0000000000400000-0x0000000002B9C000-memory.dmp

    Filesize

    39.6MB