25eec917e2c8860d22310b6a3c3e7b65a8d4b9d3797231df7a0f1a6f7f49c29f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
Size

184KB
MD5

e25e2c5f4d64bd667c2d067824ec6d04
SHA1

4d06af284161f209f89264ea8c1600b0b2a889b3
SHA256

25eec917e2c8860d22310b6a3c3e7b65a8d4b9d3797231df7a0f1a6f7f49c29f
SHA512

e6958e3c48169f324f25d40254e08ab39253f415e1f3263394ab92f012f627efb8c66694d9f69ff79c453bcdb0ed38cd7d845e30d556ae2a6a88c093ebfdb3b3
SSDEEP

3072:gLk395hYXJG45+cm98cEUGnusLlKJHjy4dtvsq3RVTQeQTI6R53EUuo2bqU4dD:gQqU1cmSvPejtdt1TQeQFUXo24dD

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\1ClickDownload\Naruto_Manga_Chapter_573_(HQ)_7MB_PNG-JPG.torrent	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
File created	C:\Program Files (x86)\1ClickDownload\mainproduct.tmp	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
File created	C:\Program Files (x86)\1ClickDownload\OneClickLib.dll	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
344	2552	WerFault.exe	27

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 344	2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe	29
PID 2552 wrote to memory of 344	2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe	29
PID 2552 wrote to memory of 344	2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe	29
PID 2552 wrote to memory of 344	2552	JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe	29

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e25e2c5f4d64bd667c2d067824ec6d04.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 748
  2⤵
  - Program crash
  PID:344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy55BF.tmp\accept2.bmp

Filesize
16KB

MD5
f642e8cfce23aa5d124533357de7394b

SHA1
80ce98a2bc4b416db357ea52a74424d742cfaa55

SHA256
f1bed304ea1d96094c1e4e3f8e112b7ce15af4441192e73c9144f774ad132d2e

SHA512
d0ec47e3a69cc6c6f54e8ba58cade7875ace43b66946e7bd4b678dc246c61acf8d36aeaf80082308f08783c28424c5db601bdde1d820f7797b60ca4fe948ad26

Download Submit
\Users\Admin\AppData\Local\Temp\nsy55BF.tmp\EBanner.dll

Filesize
5KB

MD5
cce7bc13dbc3faea7769fcf7727eb19f

SHA1
59633ed1adc02235ca058883534ff36be4fb3f37

SHA256
dd519ae6d7fd6df0c32db834df215df2fe7c1d044b800922a58da7f4f00b95ab

SHA512
21e4a8ecd383d59ef24f590367328248d21c7fe452fc5c3a42ec597f920e79caf6a8047babb9fb44d2cca8329dd7d14b39cf13a0934aee409fa5bdd7c2e4f121

Download Submit
\Users\Admin\AppData\Local\Temp\nsy55BF.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsy55BF.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsy55BF.tmp\inetc3.dll

Filesize
23KB

MD5
481bc38292bc93613f0b0954a57e8948

SHA1
dc449a32297191e8eaf76706c3a7370e43478379

SHA256
49f0cceffd8a0b529910bd3b3943d047453593460393eb69869cffb3143cade5

SHA512
e09b975000214cc04422a144d570bd162e8492fc867a824edf59d33a97f7ed76eba3b6de5791ce2ed3785f101ceff972b872a0ac8d63419bd04ca6a1295aa011

Download Submit
\Users\Admin\AppData\Local\Temp\nsy55BF.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit