Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
22-12-2024 08:36
General
-
Target
JaffaCakes118_7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934.exe
-
Size
324KB
-
MD5
32e769af31bd04eaf3d67dc674e94356
-
SHA1
a12e0d84642174ae9fc5308bee1dc1c6cdce832e
-
SHA256
7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934
-
SHA512
1a0b1be06ee1c2cd82074131fc9012bb75830d3dd69b4f0fad8dafa4906a67d39a1b72945350b65d06bb553874357785a8eb74d094d26dc963314ffce39a99d4
-
SSDEEP
6144:HAIzXLEMwbeM+N9XqSGuXSV9I3I0KEGMMs+bYYsG08a5:HAuzwbeM+vqHKKO52YO08W
Malware Config
Extracted
gcleaner
45.139.105.171
85.31.46.167
107.182.129.235
171.22.30.106
-
url_path
....!..../software.php
....!..../software.php
Signatures
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Gcleaner family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c506d65fa9d1c3e00796777d8516dfdca8d975c03cd7542b485be6064bb4934.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
40.2MB
-
Filesize
272KB