5cddda38dd85934cf5cd0d10dac085bbe81dedd3a38132dae3972a316f56a78b

Analysis

max time kernel
5s
max time network
0s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe
Size

260KB
MD5

8a90117a3ca882ddd388507860b36a84
SHA1

73cabd6d3fe71d3fd2752ddeb44e30cc538ec826
SHA256

5cddda38dd85934cf5cd0d10dac085bbe81dedd3a38132dae3972a316f56a78b
SHA512

02694474f99bd55d379bd826e23ee65414acb78f20cebb434b31dff436a00a5dcc11c2f7b2ea5c7f00c87c5c0c00117773b1d31af023d141034303c225a17b56
SSDEEP

6144:Qd7YgTSrMaIl/jcLijfHFEHWzXvjT85R:QR9TSrMaIqLlI/H85R

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2852	twnaes.exe

Loads dropped DLL 2 IoCs

pid	Process
2848	JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe
2848	JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twnaes.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2852	twnaes.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2848	JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe
2852	twnaes.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2852	2848	JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe	30
PID 2848 wrote to memory of 2852	2848	JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe	30
PID 2848 wrote to memory of 2852	2848	JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe	30
PID 2848 wrote to memory of 2852	2848	JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a90117a3ca882ddd388507860b36a84.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\twnaes.exe
  "C:\Users\Admin\twnaes.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\twnaes.exe

Filesize
260KB

MD5
cb6d56a1b2e20013a60badd16596e9ae

SHA1
848a3ef1bea70ce7a9df6534138a371c09fb0561

SHA256
09b275bbf749bf2fc7b7f7ec6cad7e5ba003d36f06ad865e03e609f06082f46c

SHA512
f1ff739451c13c666f43d60df1358783f9d7cf389b6d97c016e9ea5c85f9d684711d6ecf6b54c73aa70574c919986bda3f188087dee8af016557fa38d959d0dd

Download Submit